@xopcai/xopc 0.0.88 → 0.0.90

package/dist/src/gateway/hono/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/auth.ts"],"sourcesContent":["import { createMiddleware } from 'hono/factory';\nimport type { Context } from 'hono';\nimport { getConnInfo } from '@hono/node-server/conninfo';\n\nimport type { GatewayAuthConfig } from '../../../config/schema.js';\nimport type { ResolvedGatewayAuth } from '../../auth.js';\nimport { resolveClientIpFromRequest } from '../../client-ip.js';\nimport {\n  authPolicyConfig,\n  buckets,\n  isAuthRateLimitGloballyDisabled,\n  resolveAuthRateLimit,\n  resolveAuthTracking,\n  type ResolvedAuthRateLimitConfig,\n} from '../../rate-limit/index.js';\nimport { getClientIpFromHeaders } from '../../security/loopback.js';\nimport { safeEqualSecret } from '../../security/secret-equal.js';\nimport { authorizeTrustedProxy } from '../../trusted-proxy.js';\nimport { createLogger } from '../../../utils/logger.js';\n\nconst log = createLogger('Hono:Auth');\n\nexport interface AuthConfig {\n  token?: string;\n  /** Current gateway auth from config (for rate-limit settings); optional. */\n  getGatewayAuth?: () => GatewayAuthConfig | undefined;\n  getResolvedAuth?: () => ResolvedGatewayAuth;\n  getTrustedProxyContext?: () => {\n    trustedProxies?: string[];\n    allowRealIpFallback?: boolean;\n  };\n}\n\nfunction validateToken(providedToken: string | undefined, expectedToken: string): boolean {\n  if (!providedToken) return false;\n  return safeEqualSecret(providedToken, expectedToken);\n}\n\nfunction extractTokenFromHeader(authHeader: string | null): string | null {\n  if (!authHeader) return null;\n  const parts = authHeader.split(' ');\n  if (parts.length === 2 && parts[0].toLowerCase() === 'bearer') return parts[1];\n  return authHeader;\n}\n\n/**\n * SECURITY: query-string tokens leak into server logs, Referer headers, and\n * browser history. We accept them only for SSE/WebSocket connections where\n * the `Authorization` header cannot be set by `EventSource`. For normal REST\n * requests prefer the `Authorization: Bearer <token>` header.\n */\nfunction extractTokenFromQuery(url: string): string | null {\n  return new URL(url).searchParams.get('token');\n}\n\nconst QUERY_TOKEN_ALLOWED_PATHS = new Set(['/api/events', '/api/ws']);\n\nfunction isQueryTokenAllowedPath(path: string): boolean {\n  return QUERY_TOKEN_ALLOWED_PATHS.has(path) || path.startsWith('/api/events');\n}\n\nfunction resolveRemoteAddress(c: Context): string | undefined {\n  try {\n    return getConnInfo(c).remote.address;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction resolveMiddlewareClientIp(\n  c: Context,\n  trustedProxies?: string[],\n  allowRealIpFallback?: boolean,\n): string {\n  if (trustedProxies?.length) {\n    return resolveClientIpFromRequest({\n      remoteAddress: resolveRemoteAddress(c),\n      getHeader: (name) => c.req.header(name),\n      trustedProxies,\n      allowRealIpFallback,\n    });\n  }\n  return getClientIpFromHeaders({\n    get: (name: string) => c.req.header(name) ?? undefined,\n  });\n}\n\ntype RateLimitContext = {\n  active: boolean;\n  cfg: ResolvedAuthRateLimitConfig;\n  /** `undefined` when the client is exempted (loopback, disabled, etc.). */\n  trackingKey: string | undefined;\n};\n\nfunction buildRateLimitContext(\n  getGatewayAuth: AuthConfig['getGatewayAuth'],\n  clientIp: string,\n  origin: string | undefined,\n): RateLimitContext {\n  const cfg = resolveAuthRateLimit(getGatewayAuth?.()?.rateLimit);\n  const active = cfg.enabled && !isAuthRateLimitGloballyDisabled();\n  if (!active) return { active: false, cfg, trackingKey: undefined };\n  const tracking = resolveAuthTracking({ clientIp, origin, cfg: authPolicyConfig(cfg) });\n  return {\n    active: true,\n    cfg,\n    trackingKey: tracking.exempt ? undefined : tracking.key,\n  };\n}\n\nfunction checkBlocked(rl: RateLimitContext): { blocked: false } | { blocked: true; retryAfterSec: number } {\n  if (!rl.active || rl.trackingKey === undefined) return { blocked: false };\n  return buckets.authFailure(rl.cfg).check(rl.trackingKey);\n}\n\nfunction recordFailure(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).fail(rl.trackingKey);\n}\n\nfunction recordSuccess(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).succeed(rl.trackingKey);\n}\n\nfunction blockedResponse(c: Context, retryAfterSec: number) {\n  c.header('Retry-After', String(retryAfterSec));\n  return c.json(\n    {\n      error: 'Too Many Requests',\n      code: 'auth_blocked',\n      message: 'Too many authentication attempts',\n      retryAfter: retryAfterSec,\n    },\n    429,\n  );\n}\n\nexport function auth(config?: AuthConfig) {\n  const { token, getGatewayAuth, getResolvedAuth, getTrustedProxyContext } = config || {};\n\n  return createMiddleware(async (c, next) => {\n    const resolvedAuth = getResolvedAuth?.();\n    const authMode = resolvedAuth?.mode ?? (token ? 'token' : 'none');\n\n    if (authMode === 'trusted-proxy') {\n      const proxyContext = getTrustedProxyContext?.();\n      const trustedProxies = proxyContext?.trustedProxies;\n      const trustedProxyConfig = resolvedAuth?.trustedProxy;\n\n      const clientIp = resolveMiddlewareClientIp(c, trustedProxies, proxyContext?.allowRealIpFallback);\n      const origin = c.req.header('origin');\n      const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n      // Server misconfiguration — not an attack signal. Don't count.\n      if (!trustedProxyConfig) {\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: 'trusted_proxy_config_missing' },\n          'HTTP auth rejected: trusted-proxy config missing',\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'auth_unconfigured', message: 'Trusted-proxy auth is not configured' },\n          401,\n        );\n      }\n\n      const blocked = checkBlocked(rl);\n      if (blocked.blocked) {\n        log.warn(\n          { clientIp, origin: origin ?? undefined, path: c.req.path, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n          'Auth rate limit blocked',\n        );\n        return blockedResponse(c, blocked.retryAfterSec);\n      }\n\n      const result = authorizeTrustedProxy({\n        remoteAddress: resolveRemoteAddress(c),\n        getHeader: (name) => c.req.header(name),\n        trustedProxies,\n        trustedProxyConfig,\n      });\n\n      if (result.ok === false) {\n        recordFailure(rl);\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: result.reason },\n          `HTTP auth rejected: trusted-proxy validation failed (${result.reason})`,\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'invalid_proxy_credentials', message: 'Trusted-proxy authentication failed' },\n          401,\n        );\n      }\n\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    if (authMode === 'none' || !token) {\n      return next();\n    }\n\n    const proxyContext = getTrustedProxyContext?.();\n    const clientIp = resolveMiddlewareClientIp(c, proxyContext?.trustedProxies, proxyContext?.allowRealIpFallback);\n    const origin = c.req.header('origin');\n    const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n    const authHeader = extractTokenFromHeader(c.req.header('authorization'));\n    const requestPath = new URL(c.req.url).pathname;\n    const queryToken = isQueryTokenAllowedPath(requestPath) ? extractTokenFromQuery(c.req.url) : null;\n\n    if (!authHeader && queryToken === null && new URL(c.req.url).searchParams.has('token')) {\n      log.warn(\n        { path: requestPath, method: c.req.method, clientIp },\n        'Token in query string rejected: use Authorization header for this endpoint',\n      );\n    }\n\n    const providedToken = authHeader || queryToken;\n\n    if (providedToken && validateToken(providedToken, token)) {\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    const blocked = checkBlocked(rl);\n    if (blocked.blocked) {\n      log.warn(\n        { clientIp, origin: origin ?? undefined, path: requestPath, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n        'Auth rate limit blocked',\n      );\n      return blockedResponse(c, blocked.retryAfterSec);\n    }\n\n    // Missing token is an unauthenticated request, not a brute-force signal —\n    // page reloads / SDK cold starts often hit endpoints before the token is\n    // attached. Counting this would lock users out of the token-entry path.\n    if (!providedToken) {\n      log.warn(\n        { path: c.req.path, method: c.req.method, clientIp, reason: 'missing_token' },\n        'HTTP auth rejected: no Bearer or ?token=',\n      );\n      return c.json(\n        { error: 'Unauthorized', code: 'missing_token', message: 'Missing authentication token' },\n        401,\n      );\n    }\n\n    recordFailure(rl);\n    log.warn(\n      { path: c.req.path, method: c.req.method, clientIp, reason: 'invalid_token' },\n      'HTTP auth rejected: token mismatch',\n    );\n    return c.json(\n      { error: 'Unauthorized', code: 'invalid_token', message: 'Invalid authentication token' },\n      401,\n    );\n  });\n}\n"],"mappings":";;;;;;;;;;;;;aAkBwD;AAExD,MAAM,MAAM,aAAa,YAAY;AAarC,SAAS,cAAc,eAAmC,eAAgC;AACxF,KAAI,CAAC,cAAe,QAAO;AAC3B,QAAO,gBAAgB,eAAe,cAAc;;AAGtD,SAAS,uBAAuB,YAA0C;AACxE,KAAI,CAAC,WAAY,QAAO;CACxB,MAAM,QAAQ,WAAW,MAAM,IAAI;AACnC,KAAI,MAAM,WAAW,KAAK,MAAM,GAAG,aAAa,KAAK,SAAU,QAAO,MAAM;AAC5E,QAAO;;;;;;;;AAST,SAAS,sBAAsB,KAA4B;AACzD,QAAO,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ;;AAG/C,MAAM,4BAA4B,IAAI,IAAI,CAAC,eAAe,UAAU,CAAC;AAErE,SAAS,wBAAwB,MAAuB;AACtD,QAAO,0BAA0B,IAAI,KAAK,IAAI,KAAK,WAAW,cAAc;;AAG9E,SAAS,qBAAqB,GAAgC;AAC5D,KAAI;AACF,SAAO,YAAY,EAAE,CAAC,OAAO;SACvB;AACN;;;AAIJ,SAAS,0BACP,GACA,gBACA,qBACQ;AACR,KAAI,gBAAgB,OAClB,QAAO,2BAA2B;EAChC,eAAe,qBAAqB,EAAE;EACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;EACvC;EACA;EACD,CAAC;AAEJ,QAAO,uBAAuB,EAC5B,MAAM,SAAiB,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GAC9C,CAAC;;AAUJ,SAAS,sBACP,gBACA,UACA,QACkB;CAClB,MAAM,MAAM,qBAAqB,kBAAkB,EAAE,UAAU;AAE/D,KAAI,EADW,IAAI,WAAW,CAAC,iCAAiC,EACnD,QAAO;EAAE,QAAQ;EAAO;EAAK,aAAa,KAAA;EAAW;CAClE,MAAM,WAAW,oBAAoB;EAAE;EAAU;EAAQ,KAAK,iBAAiB,IAAI;EAAE,CAAC;AACtF,QAAO;EACL,QAAQ;EACR;EACA,aAAa,SAAS,SAAS,KAAA,IAAY,SAAS;EACrD;;AAGH,SAAS,aAAa,IAAqF;AACzG,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW,QAAO,EAAE,SAAS,OAAO;AACzE,QAAO,QAAQ,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,YAAY;;AAG1D,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,KAAK,GAAG,YAAY;;AAGlD,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,QAAQ,GAAG,YAAY;;AAGrD,SAAS,gBAAgB,GAAY,eAAuB;AAC1D,GAAE,OAAO,eAAe,OAAO,cAAc,CAAC;AAC9C,QAAO,EAAE,KACP;EACE,OAAO;EACP,MAAM;EACN,SAAS;EACT,YAAY;EACb,EACD,IACD;;AAGH,SAAgB,KAAK,QAAqB;CACxC,MAAM,EAAE,OAAO,gBAAgB,iBAAiB,2BAA2B,UAAU,EAAE;AAEvF,QAAO,iBAAiB,OAAO,GAAG,SAAS;EACzC,MAAM,eAAe,mBAAmB;EACxC,MAAM,WAAW,cAAc,SAAS,QAAQ,UAAU;AAE1D,MAAI,aAAa,iBAAiB;GAChC,MAAM,eAAe,0BAA0B;GAC/C,MAAM,iBAAiB,cAAc;GACrC,MAAM,qBAAqB,cAAc;GAEzC,MAAM,WAAW,0BAA0B,GAAG,gBAAgB,cAAc,oBAAoB;GAChG,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;GACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;AAGlE,OAAI,CAAC,oBAAoB;AACvB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ;KAAgC,EAC5F,mDACD;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAAqB,SAAS;KAAwC,EACrG,IACD;;GAGH,MAAM,UAAU,aAAa,GAAG;AAChC,OAAI,QAAQ,SAAS;AACnB,QAAI,KACF;KAAE;KAAU,QAAQ,UAAU,KAAA;KAAW,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ,eAAe,QAAQ;KAAe,QAAQ;KAAgB,EAC/I,0BACD;AACD,WAAO,gBAAgB,GAAG,QAAQ,cAAc;;GAGlD,MAAM,SAAS,sBAAsB;IACnC,eAAe,qBAAqB,EAAE;IACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;IACvC;IACA;IACD,CAAC;AAEF,OAAI,OAAO,OAAO,OAAO;AACvB,kBAAc,GAAG;AACjB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ,OAAO;KAAQ,EAC3E,wDAAwD,OAAO,OAAO,GACvE;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAA6B,SAAS;KAAuC,EAC5G,IACD;;AAGH,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;AAGF,MAAI,aAAa,UAAU,CAAC,MAC1B,QAAO,MAAM;EAGf,MAAM,eAAe,0BAA0B;EAC/C,MAAM,WAAW,0BAA0B,GAAG,cAAc,gBAAgB,cAAc,oBAAoB;EAC9G,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;EACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;EAElE,MAAM,aAAa,uBAAuB,EAAE,IAAI,OAAO,gBAAgB,CAAC;EACxE,MAAM,cAAc,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC;EACvC,MAAM,aAAa,wBAAwB,YAAY,GAAG,sBAAsB,EAAE,IAAI,IAAI,GAAG;AAE7F,MAAI,CAAC,cAAc,eAAe,QAAQ,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ,CACpF,KAAI,KACF;GAAE,MAAM;GAAa,QAAQ,EAAE,IAAI;GAAQ;GAAU,EACrD,6EACD;EAGH,MAAM,gBAAgB,cAAc;AAEpC,MAAI,iBAAiB,cAAc,eAAe,MAAM,EAAE;AACxD,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;EAGF,MAAM,UAAU,aAAa,GAAG;AAChC,MAAI,QAAQ,SAAS;AACnB,OAAI,KACF;IAAE;IAAU,QAAQ,UAAU,KAAA;IAAW,MAAM;IAAa,QAAQ,EAAE,IAAI;IAAQ,eAAe,QAAQ;IAAe,QAAQ;IAAgB,EAChJ,0BACD;AACD,UAAO,gBAAgB,GAAG,QAAQ,cAAc;;AAMlD,MAAI,CAAC,eAAe;AAClB,OAAI,KACF;IAAE,MAAM,EAAE,IAAI;IAAM,QAAQ,EAAE,IAAI;IAAQ;IAAU,QAAQ;IAAiB,EAC7E,2CACD;AACD,UAAO,EAAE,KACP;IAAE,OAAO;IAAgB,MAAM;IAAiB,SAAS;IAAgC,EACzF,IACD;;AAGH,gBAAc,GAAG;AACjB,MAAI,KACF;GAAE,MAAM,EAAE,IAAI;GAAM,QAAQ,EAAE,IAAI;GAAQ;GAAU,QAAQ;GAAiB,EAC7E,qCACD;AACD,SAAO,EAAE,KACP;GAAE,OAAO;GAAgB,MAAM;GAAiB,SAAS;GAAgC,EACzF,IACD;GACD"}
+{"version":3,"file":"auth.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/auth.ts"],"sourcesContent":["import { createMiddleware } from 'hono/factory';\nimport type { Context } from 'hono';\nimport { getConnInfo } from '@hono/node-server/conninfo';\n\nimport type { GatewayAuthConfig } from '../../../config/schema.js';\nimport type { ResolvedGatewayAuth } from '../../auth.js';\nimport { resolveClientIpFromRequest } from '../../client-ip.js';\nimport {\n  authPolicyConfig,\n  buckets,\n  isAuthRateLimitGloballyDisabled,\n  resolveAuthRateLimit,\n  resolveAuthTracking,\n  type ResolvedAuthRateLimitConfig,\n} from '../../rate-limit/index.js';\nimport { getClientIpFromHeaders } from '../../security/loopback.js';\nimport { safeEqualSecret } from '../../security/secret-equal.js';\nimport { authorizeTrustedProxy } from '../../trusted-proxy.js';\nimport { createLogger } from '../../../utils/logger.js';\n\nconst log = createLogger('Hono:Auth');\n\nexport interface AuthConfig {\n  token?: string;\n  /** Current gateway auth from config (for rate-limit settings); optional. */\n  getGatewayAuth?: () => GatewayAuthConfig | undefined;\n  getResolvedAuth?: () => ResolvedGatewayAuth;\n  getTrustedProxyContext?: () => {\n    trustedProxies?: string[];\n    allowRealIpFallback?: boolean;\n  };\n}\n\nfunction validateToken(providedToken: string | undefined, expectedToken: string): boolean {\n  if (!providedToken) return false;\n  return safeEqualSecret(providedToken, expectedToken);\n}\n\nfunction extractTokenFromHeader(authHeader: string | null): string | null {\n  if (!authHeader) return null;\n  const parts = authHeader.split(' ');\n  if (parts.length === 2 && parts[0].toLowerCase() === 'bearer') return parts[1];\n  return authHeader;\n}\n\n/**\n * SECURITY: query-string tokens leak into server logs, Referer headers, and\n * browser history. We accept them only where the `Authorization` header cannot\n * be set — SSE/WebSocket (`EventSource`) and `<img>` subresource loads for agent\n * avatars. For normal REST requests prefer the `Authorization: Bearer <token>`\n * header.\n */\nfunction extractTokenFromQuery(url: string): string | null {\n  return new URL(url).searchParams.get('token');\n}\n\nconst QUERY_TOKEN_ALLOWED_PATHS = new Set(['/api/events', '/api/ws']);\n\nconst AGENT_AVATAR_GET_PATH = /^\\/api\\/agents\\/[^/]+\\/avatar$/;\n\n/** Exported for gateway security tests. */\nexport function isQueryTokenAllowedPath(path: string, method: string): boolean {\n  if (QUERY_TOKEN_ALLOWED_PATHS.has(path) || path.startsWith('/api/events')) {\n    return true;\n  }\n  // `<img src>` cannot send Bearer tokens; gateway console loads custom avatars here.\n  if (method === 'GET' && AGENT_AVATAR_GET_PATH.test(path)) {\n    return true;\n  }\n  return false;\n}\n\nfunction resolveRemoteAddress(c: Context): string | undefined {\n  try {\n    return getConnInfo(c).remote.address;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction resolveMiddlewareClientIp(\n  c: Context,\n  trustedProxies?: string[],\n  allowRealIpFallback?: boolean,\n): string {\n  if (trustedProxies?.length) {\n    return resolveClientIpFromRequest({\n      remoteAddress: resolveRemoteAddress(c),\n      getHeader: (name) => c.req.header(name),\n      trustedProxies,\n      allowRealIpFallback,\n    });\n  }\n  return getClientIpFromHeaders({\n    get: (name: string) => c.req.header(name) ?? undefined,\n  });\n}\n\ntype RateLimitContext = {\n  active: boolean;\n  cfg: ResolvedAuthRateLimitConfig;\n  /** `undefined` when the client is exempted (loopback, disabled, etc.). */\n  trackingKey: string | undefined;\n};\n\nfunction buildRateLimitContext(\n  getGatewayAuth: AuthConfig['getGatewayAuth'],\n  clientIp: string,\n  origin: string | undefined,\n): RateLimitContext {\n  const cfg = resolveAuthRateLimit(getGatewayAuth?.()?.rateLimit);\n  const active = cfg.enabled && !isAuthRateLimitGloballyDisabled();\n  if (!active) return { active: false, cfg, trackingKey: undefined };\n  const tracking = resolveAuthTracking({ clientIp, origin, cfg: authPolicyConfig(cfg) });\n  return {\n    active: true,\n    cfg,\n    trackingKey: tracking.exempt ? undefined : tracking.key,\n  };\n}\n\nfunction checkBlocked(rl: RateLimitContext): { blocked: false } | { blocked: true; retryAfterSec: number } {\n  if (!rl.active || rl.trackingKey === undefined) return { blocked: false };\n  return buckets.authFailure(rl.cfg).check(rl.trackingKey);\n}\n\nfunction recordFailure(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).fail(rl.trackingKey);\n}\n\nfunction recordSuccess(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).succeed(rl.trackingKey);\n}\n\nfunction blockedResponse(c: Context, retryAfterSec: number) {\n  c.header('Retry-After', String(retryAfterSec));\n  return c.json(\n    {\n      error: 'Too Many Requests',\n      code: 'auth_blocked',\n      message: 'Too many authentication attempts',\n      retryAfter: retryAfterSec,\n    },\n    429,\n  );\n}\n\nexport function auth(config?: AuthConfig) {\n  const { token, getGatewayAuth, getResolvedAuth, getTrustedProxyContext } = config || {};\n\n  return createMiddleware(async (c, next) => {\n    const resolvedAuth = getResolvedAuth?.();\n    const authMode = resolvedAuth?.mode ?? (token ? 'token' : 'none');\n\n    if (authMode === 'trusted-proxy') {\n      const proxyContext = getTrustedProxyContext?.();\n      const trustedProxies = proxyContext?.trustedProxies;\n      const trustedProxyConfig = resolvedAuth?.trustedProxy;\n\n      const clientIp = resolveMiddlewareClientIp(c, trustedProxies, proxyContext?.allowRealIpFallback);\n      const origin = c.req.header('origin');\n      const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n      // Server misconfiguration — not an attack signal. Don't count.\n      if (!trustedProxyConfig) {\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: 'trusted_proxy_config_missing' },\n          'HTTP auth rejected: trusted-proxy config missing',\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'auth_unconfigured', message: 'Trusted-proxy auth is not configured' },\n          401,\n        );\n      }\n\n      const blocked = checkBlocked(rl);\n      if (blocked.blocked) {\n        log.warn(\n          { clientIp, origin: origin ?? undefined, path: c.req.path, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n          'Auth rate limit blocked',\n        );\n        return blockedResponse(c, blocked.retryAfterSec);\n      }\n\n      const result = authorizeTrustedProxy({\n        remoteAddress: resolveRemoteAddress(c),\n        getHeader: (name) => c.req.header(name),\n        trustedProxies,\n        trustedProxyConfig,\n      });\n\n      if (result.ok === false) {\n        recordFailure(rl);\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: result.reason },\n          `HTTP auth rejected: trusted-proxy validation failed (${result.reason})`,\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'invalid_proxy_credentials', message: 'Trusted-proxy authentication failed' },\n          401,\n        );\n      }\n\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    if (authMode === 'none' || !token) {\n      return next();\n    }\n\n    const proxyContext = getTrustedProxyContext?.();\n    const clientIp = resolveMiddlewareClientIp(c, proxyContext?.trustedProxies, proxyContext?.allowRealIpFallback);\n    const origin = c.req.header('origin');\n    const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n    const authHeader = extractTokenFromHeader(c.req.header('authorization'));\n    const requestPath = new URL(c.req.url).pathname;\n    const queryToken = isQueryTokenAllowedPath(requestPath, c.req.method)\n      ? extractTokenFromQuery(c.req.url)\n      : null;\n\n    if (!authHeader && queryToken === null && new URL(c.req.url).searchParams.has('token')) {\n      log.warn(\n        { path: requestPath, method: c.req.method, clientIp },\n        'Token in query string rejected: use Authorization header for this endpoint',\n      );\n    }\n\n    const providedToken = authHeader || queryToken;\n\n    if (providedToken && validateToken(providedToken, token)) {\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    const blocked = checkBlocked(rl);\n    if (blocked.blocked) {\n      log.warn(\n        { clientIp, origin: origin ?? undefined, path: requestPath, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n        'Auth rate limit blocked',\n      );\n      return blockedResponse(c, blocked.retryAfterSec);\n    }\n\n    // Missing token is an unauthenticated request, not a brute-force signal —\n    // page reloads / SDK cold starts often hit endpoints before the token is\n    // attached. Counting this would lock users out of the token-entry path.\n    if (!providedToken) {\n      log.warn(\n        { path: c.req.path, method: c.req.method, clientIp, reason: 'missing_token' },\n        'HTTP auth rejected: no Bearer or ?token=',\n      );\n      return c.json(\n        { error: 'Unauthorized', code: 'missing_token', message: 'Missing authentication token' },\n        401,\n      );\n    }\n\n    recordFailure(rl);\n    log.warn(\n      { path: c.req.path, method: c.req.method, clientIp, reason: 'invalid_token' },\n      'HTTP auth rejected: token mismatch',\n    );\n    return c.json(\n      { error: 'Unauthorized', code: 'invalid_token', message: 'Invalid authentication token' },\n      401,\n    );\n  });\n}\n"],"mappings":";;;;;;;;;;;;;aAkBwD;AAExD,MAAM,MAAM,aAAa,YAAY;AAarC,SAAS,cAAc,eAAmC,eAAgC;AACxF,KAAI,CAAC,cAAe,QAAO;AAC3B,QAAO,gBAAgB,eAAe,cAAc;;AAGtD,SAAS,uBAAuB,YAA0C;AACxE,KAAI,CAAC,WAAY,QAAO;CACxB,MAAM,QAAQ,WAAW,MAAM,IAAI;AACnC,KAAI,MAAM,WAAW,KAAK,MAAM,GAAG,aAAa,KAAK,SAAU,QAAO,MAAM;AAC5E,QAAO;;;;;;;;;AAUT,SAAS,sBAAsB,KAA4B;AACzD,QAAO,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ;;AAG/C,MAAM,4BAA4B,IAAI,IAAI,CAAC,eAAe,UAAU,CAAC;AAErE,MAAM,wBAAwB;;AAG9B,SAAgB,wBAAwB,MAAc,QAAyB;AAC7E,KAAI,0BAA0B,IAAI,KAAK,IAAI,KAAK,WAAW,cAAc,CACvE,QAAO;AAGT,KAAI,WAAW,SAAS,sBAAsB,KAAK,KAAK,CACtD,QAAO;AAET,QAAO;;AAGT,SAAS,qBAAqB,GAAgC;AAC5D,KAAI;AACF,SAAO,YAAY,EAAE,CAAC,OAAO;SACvB;AACN;;;AAIJ,SAAS,0BACP,GACA,gBACA,qBACQ;AACR,KAAI,gBAAgB,OAClB,QAAO,2BAA2B;EAChC,eAAe,qBAAqB,EAAE;EACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;EACvC;EACA;EACD,CAAC;AAEJ,QAAO,uBAAuB,EAC5B,MAAM,SAAiB,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GAC9C,CAAC;;AAUJ,SAAS,sBACP,gBACA,UACA,QACkB;CAClB,MAAM,MAAM,qBAAqB,kBAAkB,EAAE,UAAU;AAE/D,KAAI,EADW,IAAI,WAAW,CAAC,iCAAiC,EACnD,QAAO;EAAE,QAAQ;EAAO;EAAK,aAAa,KAAA;EAAW;CAClE,MAAM,WAAW,oBAAoB;EAAE;EAAU;EAAQ,KAAK,iBAAiB,IAAI;EAAE,CAAC;AACtF,QAAO;EACL,QAAQ;EACR;EACA,aAAa,SAAS,SAAS,KAAA,IAAY,SAAS;EACrD;;AAGH,SAAS,aAAa,IAAqF;AACzG,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW,QAAO,EAAE,SAAS,OAAO;AACzE,QAAO,QAAQ,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,YAAY;;AAG1D,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,KAAK,GAAG,YAAY;;AAGlD,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,QAAQ,GAAG,YAAY;;AAGrD,SAAS,gBAAgB,GAAY,eAAuB;AAC1D,GAAE,OAAO,eAAe,OAAO,cAAc,CAAC;AAC9C,QAAO,EAAE,KACP;EACE,OAAO;EACP,MAAM;EACN,SAAS;EACT,YAAY;EACb,EACD,IACD;;AAGH,SAAgB,KAAK,QAAqB;CACxC,MAAM,EAAE,OAAO,gBAAgB,iBAAiB,2BAA2B,UAAU,EAAE;AAEvF,QAAO,iBAAiB,OAAO,GAAG,SAAS;EACzC,MAAM,eAAe,mBAAmB;EACxC,MAAM,WAAW,cAAc,SAAS,QAAQ,UAAU;AAE1D,MAAI,aAAa,iBAAiB;GAChC,MAAM,eAAe,0BAA0B;GAC/C,MAAM,iBAAiB,cAAc;GACrC,MAAM,qBAAqB,cAAc;GAEzC,MAAM,WAAW,0BAA0B,GAAG,gBAAgB,cAAc,oBAAoB;GAChG,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;GACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;AAGlE,OAAI,CAAC,oBAAoB;AACvB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ;KAAgC,EAC5F,mDACD;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAAqB,SAAS;KAAwC,EACrG,IACD;;GAGH,MAAM,UAAU,aAAa,GAAG;AAChC,OAAI,QAAQ,SAAS;AACnB,QAAI,KACF;KAAE;KAAU,QAAQ,UAAU,KAAA;KAAW,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ,eAAe,QAAQ;KAAe,QAAQ;KAAgB,EAC/I,0BACD;AACD,WAAO,gBAAgB,GAAG,QAAQ,cAAc;;GAGlD,MAAM,SAAS,sBAAsB;IACnC,eAAe,qBAAqB,EAAE;IACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;IACvC;IACA;IACD,CAAC;AAEF,OAAI,OAAO,OAAO,OAAO;AACvB,kBAAc,GAAG;AACjB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ,OAAO;KAAQ,EAC3E,wDAAwD,OAAO,OAAO,GACvE;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAA6B,SAAS;KAAuC,EAC5G,IACD;;AAGH,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;AAGF,MAAI,aAAa,UAAU,CAAC,MAC1B,QAAO,MAAM;EAGf,MAAM,eAAe,0BAA0B;EAC/C,MAAM,WAAW,0BAA0B,GAAG,cAAc,gBAAgB,cAAc,oBAAoB;EAC9G,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;EACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;EAElE,MAAM,aAAa,uBAAuB,EAAE,IAAI,OAAO,gBAAgB,CAAC;EACxE,MAAM,cAAc,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC;EACvC,MAAM,aAAa,wBAAwB,aAAa,EAAE,IAAI,OAAO,GACjE,sBAAsB,EAAE,IAAI,IAAI,GAChC;AAEJ,MAAI,CAAC,cAAc,eAAe,QAAQ,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ,CACpF,KAAI,KACF;GAAE,MAAM;GAAa,QAAQ,EAAE,IAAI;GAAQ;GAAU,EACrD,6EACD;EAGH,MAAM,gBAAgB,cAAc;AAEpC,MAAI,iBAAiB,cAAc,eAAe,MAAM,EAAE;AACxD,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;EAGF,MAAM,UAAU,aAAa,GAAG;AAChC,MAAI,QAAQ,SAAS;AACnB,OAAI,KACF;IAAE;IAAU,QAAQ,UAAU,KAAA;IAAW,MAAM;IAAa,QAAQ,EAAE,IAAI;IAAQ,eAAe,QAAQ;IAAe,QAAQ;IAAgB,EAChJ,0BACD;AACD,UAAO,gBAAgB,GAAG,QAAQ,cAAc;;AAMlD,MAAI,CAAC,eAAe;AAClB,OAAI,KACF;IAAE,MAAM,EAAE,IAAI;IAAM,QAAQ,EAAE,IAAI;IAAQ;IAAU,QAAQ;IAAiB,EAC7E,2CACD;AACD,UAAO,EAAE,KACP;IAAE,OAAO;IAAgB,MAAM;IAAiB,SAAS;IAAgC,EACzF,IACD;;AAGH,gBAAc,GAAG;AACjB,MAAI,KACF;GAAE,MAAM,EAAE,IAAI;GAAM,QAAQ,EAAE,IAAI;GAAQ;GAAU,QAAQ;GAAiB,EAC7E,qCACD;AACD,SAAO,EAAE,KACP;GAAE,OAAO;GAAgB,MAAM;GAAiB,SAAS;GAAgC,EACzF,IACD;GACD"}

package/dist/src/gateway/hono/oauth-async.js

@@ -45,7 +45,7 @@ const SESSION_TTL_MS = 600 * 1e3;
 setInterval(() => {
 	const now = Date.now();
 	for (const [id, session] of oauthSessions.entries()) if (now > session.expiresAt) {
-		if (session.abortController) session.abortController.abort();
+		cancelOAuthSession(session, "OAuth flow expired");
 		oauthSessions.delete(id);
 		log.debug({ sessionId: id }, "Cleaned up expired OAuth session");
 	}
@@ -53,6 +53,14 @@ setInterval(() => {
 function generateSessionId() {
 	return `oauth_${Date.now()}_${Math.random().toString(36).substring(2, 15)}`;
 }
+function cancelOAuthSession(session, message = "OAuth flow cancelled") {
+	if (session.abortController) session.abortController.abort();
+	if (session.manualCodeResolve) session.manualCodeResolve("");
+	session.manualCodeResolve = void 0;
+	session.manualCodeReject = void 0;
+	session.status = "cancelled";
+	session.message = message;
+}
 function createOAuthAsyncHandler(service) {
 	const oauth = new Hono();
 	/**
@@ -142,14 +150,7 @@ function createOAuthAsyncHandler(service) {
 		const sessionId = c.req.param("sessionId");
 		const session = oauthSessions.get(sessionId);
 		if (!session) return c.json({ error: "Session not found" }, 404);
-		if (session.abortController) session.abortController.abort();
-		if (session.manualCodeReject) {
-			session.manualCodeReject(/* @__PURE__ */ new Error("OAuth cancelled by user"));
-			session.manualCodeReject = void 0;
-			session.manualCodeResolve = void 0;
-		}
-		session.status = "cancelled";
-		session.message = "OAuth flow cancelled";
+		cancelOAuthSession(session);
 		return c.json({
 			ok: true,
 			payload: { message: "OAuth flow cancelled" }
@@ -162,8 +163,7 @@ function createOAuthAsyncHandler(service) {
 	oauth.delete("/:sessionId", (c) => {
 		const sessionId = c.req.param("sessionId");
 		if (oauthSessions.has(sessionId)) {
-			const session = oauthSessions.get(sessionId);
-			if (session.abortController) session.abortController.abort();
+			cancelOAuthSession(oauthSessions.get(sessionId));
 			oauthSessions.delete(sessionId);
 		}
 		return c.json({ ok: true });
@@ -197,6 +197,14 @@ async function runOAuthFlow(session, oauthProvider, _service) {
 				session.message = "Complete authorization in browser";
 			}
 		},
+		onDeviceCode: (info) => {
+			session.status = "waiting_auth";
+			session.authUrl = info.verificationUri;
+			session.deviceCode = info.userCode;
+			session.verificationUri = info.verificationUri;
+			session.instructions = `Enter code ${info.userCode}`;
+			session.message = `Open ${info.verificationUri} and enter code ${info.userCode}`;
+		},
 		onPrompt: async (prompt) => {
 			session.status = "waiting_code";
 			session.deviceCode = prompt.deviceCode;
@@ -221,13 +229,30 @@ async function runOAuthFlow(session, oauthProvider, _service) {
 			if (manualCodePromise) return manualCodePromise;
 			return "";
 		},
+		onSelect: async (prompt) => {
+			const browserOption = prompt.options.find((option) => option.id === "browser");
+			const firstOption = prompt.options[0];
+			const selectedOption = browserOption ?? firstOption;
+			if (!selectedOption) throw new Error("OAuth login did not provide any selectable auth method");
+			log.debug({
+				sessionId: session.id,
+				provider: session.provider,
+				selected: selectedOption.id
+			}, "Selected OAuth auth method");
+			return selectedOption.id;
+		},
 		signal: abortController.signal
 	};
 	try {
 		const credentials = await oauthProvider.login(callbacks);
 		setOAuthCredentialsToCache(session.provider, credentials);
-		const apiKey = oauthProvider.getApiKey(credentials);
-		await new CredentialResolver().saveApiKey(session.provider, apiKey, { profileName: "default" });
+		await new CredentialResolver().saveOAuthToken(session.provider, {
+			access: oauthProvider.getApiKey(credentials),
+			refresh: credentials.refresh,
+			expiresAt: credentials.expires,
+			scope: Array.isArray(credentials.scope) ? credentials.scope.filter((value) => typeof value === "string") : void 0,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
 		session.status = "completed";
 		session.credentials = credentials;
 		session.message = "OAuth login successful";
@@ -236,9 +261,9 @@ async function runOAuthFlow(session, oauthProvider, _service) {
 			provider: session.provider
 		}, "OAuth login completed");
 	} catch (err) {
-		if (abortController.signal.aborted) {
+		if (abortController.signal.aborted || session.status === "cancelled") {
 			session.status = "cancelled";
-			session.message = "OAuth flow cancelled by user";
+			session.message ??= "OAuth flow cancelled by user";
 		} else {
 			session.status = "failed";
 			session.error = formatOAuthAsyncError(err);

package/dist/src/gateway/hono/oauth-async.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-async.js","names":["googleGeminiCliOAuthProvider","googleAntigravityOAuthProvider"],"sources":["../../../../src/gateway/hono/oauth-async.ts"],"sourcesContent":["/**\n * Async OAuth Handler\n * \n * Provides non-blocking OAuth flow with session-based state management.\n * This allows OAuth flows that require user interaction (browser login) \n * without blocking the HTTP request.\n */\n\nimport { Hono } from 'hono';\nimport type { GatewayService } from '../service.js';\nimport { \n  type OAuthProviderInterface, \n  type OAuthLoginCallbacks,\n  type OAuthCredentials \n} from '../../auth/oauth/types.js';\nimport {\n  kimiCodingOAuthProvider,\n  minimaxOAuthProvider,\n  minimaxCnOAuthProvider,\n  anthropicOAuthProvider,\n  githubCopilotOAuthProvider,\n  googleGeminiCliOAuthProvider,\n  googleAntigravityOAuthProvider,\n  openaiCodexOAuthProvider,\n} from '../../auth/oauth/index.js';\nimport { createLogger } from '../../utils/logger.js';\nimport { CredentialResolver } from '../../auth/credentials.js';\n\nconst log = createLogger('OAuthAsync');\n\n/** User-facing message when undici/fetch fails (often DNS, firewall, or wrong machine for localhost callback). */\nfunction formatOAuthAsyncError(err: unknown): string {\n\tconst base = err instanceof Error ? err.message : 'OAuth login failed';\n\tconst cause =\n\t\terr instanceof Error && err.cause instanceof Error\n\t\t\t? err.cause.message\n\t\t\t: err instanceof Error && typeof err.cause === 'string'\n\t\t\t\t? err.cause\n\t\t\t\t: '';\n\tconst detail = cause ? ` (${cause})` : '';\n\tif (/^fetch failed$/i.test(base) || base.includes('fetch failed')) {\n\t\treturn (\n\t\t\t`Network request failed${detail}. If the browser opened on another device, the redirect goes to that device's localhost — ` +\n\t\t\t`copy the full URL from the browser address bar after sign-in (starts with http://127.0.0.1 or http://localhost) and paste it below. ` +\n\t\t\t`Otherwise check VPN/proxy/DNS/firewall access to Google OAuth.`\n\t\t);\n\t}\n\treturn base;\n}\n\n// Static OAuth providers map\nconst OAUTH_PROVIDERS: Record<string, OAuthProviderInterface> = {\n  'kimi-coding': kimiCodingOAuthProvider,\n  'minimax': minimaxOAuthProvider,\n  'minimax-cn': minimaxCnOAuthProvider,\n  'anthropic': anthropicOAuthProvider,\n  'github-copilot': githubCopilotOAuthProvider,\n  'google-gemini-cli': googleGeminiCliOAuthProvider,\n  'google-antigravity': googleAntigravityOAuthProvider,\n  'openai-codex': openaiCodexOAuthProvider,\n};\n\n// OAuth session state\ninterface OAuthSession {\n  id: string;\n  provider: string;\n  status: 'pending' | 'waiting_auth' | 'waiting_code' | 'completed' | 'failed' | 'cancelled';\n  authUrl?: string;\n  instructions?: string;\n  deviceCode?: string;\n  verificationUri?: string;\n  message?: string;\n  error?: string;\n  credentials?: OAuthCredentials;\n  createdAt: number;\n  expiresAt: number;\n  abortController?: AbortController;\n  manualCodeResolve?: (code: string) => void;\n  manualCodeReject?: (error: Error) => void;\n}\n\n// In-memory session store (could be moved to Redis for production)\nconst oauthSessions = new Map<string, OAuthSession>();\nconst SESSION_TTL_MS = 10 * 60 * 1000; // 10 minutes\n\n// Clean up expired sessions periodically\nsetInterval(() => {\n  const now = Date.now();\n  for (const [id, session] of oauthSessions.entries()) {\n    if (now > session.expiresAt) {\n      if (session.abortController) {\n        session.abortController.abort();\n      }\n      oauthSessions.delete(id);\n      log.debug({ sessionId: id }, 'Cleaned up expired OAuth session');\n    }\n  }\n}, 60 * 1000);\n\nfunction generateSessionId(): string {\n  return `oauth_${Date.now()}_${Math.random().toString(36).substring(2, 15)}`;\n}\n\nexport function createOAuthAsyncHandler(service: GatewayService) {\n  const oauth = new Hono();\n\n  /**\n   * POST /api/auth/oauth-async/start\n   * Start async OAuth flow - returns immediately with session ID\n   */\n  oauth.post('/start', async (c) => {\n    const { provider } = await c.req.json().catch(() => ({}));\n    \n    if (!provider) {\n      return c.json({ error: 'Provider is required' }, 400);\n    }\n\n    const oauthProvider = OAUTH_PROVIDERS[provider];\n    if (!oauthProvider) {\n      return c.json({ error: `Unknown OAuth provider: ${provider}` }, 400);\n    }\n\n    const sessionId = generateSessionId();\n    const session: OAuthSession = {\n      id: sessionId,\n      provider,\n      status: 'pending',\n      createdAt: Date.now(),\n      expiresAt: Date.now() + SESSION_TTL_MS,\n    };\n\n    oauthSessions.set(sessionId, session);\n\n    // Start OAuth flow in background\n    runOAuthFlow(session, oauthProvider, service).catch(err => {\n      log.error({ sessionId, provider, error: err }, 'Background OAuth flow failed');\n      session.status = 'failed';\n      session.error = err instanceof Error ? err.message : 'OAuth flow failed';\n    });\n\n    return c.json({ \n      ok: true, \n      payload: { \n        sessionId,\n        provider,\n        status: session.status,\n      } \n    });\n  });\n\n  /**\n   * GET /api/auth/oauth-async/:sessionId/status\n   * Check OAuth session status\n   */\n  oauth.get('/:sessionId/status', (c) => {\n    const sessionId = c.req.param('sessionId');\n    const session = oauthSessions.get(sessionId);\n\n    if (!session) {\n      return c.json({ error: 'Session not found' }, 404);\n    }\n\n    return c.json({ \n      ok: true, \n      payload: { \n        sessionId: session.id,\n        provider: session.provider,\n        status: session.status,\n        authUrl: session.authUrl,\n        instructions: session.instructions,\n        deviceCode: session.deviceCode,\n        verificationUri: session.verificationUri,\n        message: session.message,\n        error: session.error,\n        expiresAt: session.expiresAt,\n      } \n    });\n  });\n\n  /**\n   * POST /api/auth/oauth-async/:sessionId/code\n   * Submit manual authorization code\n   */\n  oauth.post('/:sessionId/code', async (c) => {\n    const sessionId = c.req.param('sessionId');\n    const { code } = await c.req.json().catch(() => ({}));\n    \n    if (!code) {\n      return c.json({ error: 'Code is required' }, 400);\n    }\n\n    const session = oauthSessions.get(sessionId);\n    if (!session) {\n      return c.json({ error: 'Session not found' }, 404);\n    }\n\n    if (session.status !== 'waiting_code' || !session.manualCodeResolve) {\n      return c.json({ error: 'Session is not waiting for code' }, 400);\n    }\n\n    // Resolve the manual code promise\n    session.manualCodeResolve(code);\n    session.manualCodeResolve = undefined;\n    session.manualCodeReject = undefined;\n\n    return c.json({ \n      ok: true, \n      payload: { \n        message: 'Code submitted, processing...',\n      } \n    });\n  });\n\n  /**\n   * POST /api/auth/oauth-async/:sessionId/cancel\n   * Cancel OAuth flow\n   */\n  oauth.post('/:sessionId/cancel', async (c) => {\n    const sessionId = c.req.param('sessionId');\n    const session = oauthSessions.get(sessionId);\n\n    if (!session) {\n      return c.json({ error: 'Session not found' }, 404);\n    }\n\n    if (session.abortController) {\n      session.abortController.abort();\n    }\n\n    if (session.manualCodeReject) {\n      session.manualCodeReject(new Error('OAuth cancelled by user'));\n      session.manualCodeReject = undefined;\n      session.manualCodeResolve = undefined;\n    }\n\n    session.status = 'cancelled';\n    session.message = 'OAuth flow cancelled';\n\n    return c.json({ \n      ok: true, \n      payload: { \n        message: 'OAuth flow cancelled',\n      } \n    });\n  });\n\n  /**\n   * DELETE /api/auth/oauth-async/:sessionId\n   * Clean up OAuth session\n   */\n  oauth.delete('/:sessionId', (c) => {\n    const sessionId = c.req.param('sessionId');\n    \n    if (oauthSessions.has(sessionId)) {\n      const session = oauthSessions.get(sessionId)!;\n      if (session.abortController) {\n        session.abortController.abort();\n      }\n      oauthSessions.delete(sessionId);\n    }\n\n    return c.json({ ok: true });\n  });\n\n  return oauth;\n}\n\n/**\n * Run OAuth flow in background\n */\nasync function runOAuthFlow(\n  session: OAuthSession,\n  oauthProvider: OAuthProviderInterface,\n  _service: GatewayService\n): Promise<void> {\n  const abortController = new AbortController();\n  session.abortController = abortController;\n\n  let manualCodePromise: Promise<string> | null = null;\n  let manualCodeResolve: ((code: string) => void) | undefined;\n  let manualCodeReject: ((error: Error) => void) | undefined;\n\n  const callbacks: OAuthLoginCallbacks = {\n    onAuth: (auth: { url: string; instructions?: string }) => {\n      session.authUrl = auth.url;\n      session.instructions = auth.instructions;\n      \n      if (oauthProvider.usesCallbackServer) {\n        // For callback server providers, prepare for manual code input\n        session.status = 'waiting_code';\n        session.message = 'Complete authorization in browser, or paste the redirect URL below';\n        manualCodePromise = new Promise((resolve, reject) => {\n          manualCodeResolve = resolve;\n          manualCodeReject = reject;\n        });\n        session.manualCodeResolve = manualCodeResolve;\n        session.manualCodeReject = manualCodeReject;\n      } else {\n        session.status = 'waiting_auth';\n        session.message = 'Complete authorization in browser';\n      }\n    },\n    onPrompt: async (prompt: { message: string; deviceCode?: string; verificationUri?: string }) => {\n      session.status = 'waiting_code';\n      session.deviceCode = prompt.deviceCode;\n      session.verificationUri = prompt.verificationUri;\n      session.message = prompt.message;\n      \n      // For device code flow, wait for manual input\n      manualCodePromise = new Promise((resolve, reject) => {\n        manualCodeResolve = resolve;\n        manualCodeReject = reject;\n      });\n      session.manualCodeResolve = manualCodeResolve;\n      session.manualCodeReject = manualCodeReject;\n      \n      // Return empty for now, will be resolved by manual code submission\n      return '';\n    },\n    onProgress: (message: string) => {\n      log.debug({ sessionId: session.id, message }, 'OAuth progress');\n      session.message = message;\n    },\n    onManualCodeInput: async () => {\n      // Return the manual code promise for callback server providers\n      if (manualCodePromise) {\n        return manualCodePromise;\n      }\n      return '';\n    },\n    signal: abortController.signal,\n  };\n\n  try {\n    const credentials = await oauthProvider.login(callbacks);\n    \n    // Save credentials to cache\n    setOAuthCredentialsToCache(session.provider, credentials);\n\n    // Get API key from OAuth credentials\n    const apiKey = oauthProvider.getApiKey(credentials);\n\n    // Save API key to credential system\n    const resolver = new CredentialResolver();\n    await resolver.saveApiKey(session.provider, apiKey, { profileName: 'default' });\n\n    session.status = 'completed';\n    session.credentials = credentials;\n    session.message = 'OAuth login successful';\n    \n    log.info({ sessionId: session.id, provider: session.provider }, 'OAuth login completed');\n  } catch (err) {\n    if (abortController.signal.aborted) {\n      session.status = 'cancelled';\n      session.message = 'OAuth flow cancelled by user';\n    } else {\n      session.status = 'failed';\n      session.error = formatOAuthAsyncError(err);\n      log.error({ sessionId: session.id, provider: session.provider, error: err }, 'OAuth login failed');\n    }\n  } finally {\n    session.abortController = undefined;\n    session.manualCodeResolve = undefined;\n    session.manualCodeReject = undefined;\n  }\n}\n\n// Simple in-memory cache for OAuth credentials\nconst oauthCredentialsCache: Map<string, OAuthCredentials> = new Map();\n\nexport function getOAuthCredentialsFromCache(provider: string): OAuthCredentials | undefined {\n  return oauthCredentialsCache.get(provider);\n}\n\nexport function setOAuthCredentialsToCache(provider: string, creds: OAuthCredentials): void {\n  oauthCredentialsCache.set(provider, creds);\n}\n\nexport function deleteOAuthCredentialsFromCache(provider: string): void {\n  oauthCredentialsCache.delete(provider);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;aAyBqD;kBACU;AAE/D,MAAM,MAAM,aAAa,aAAa;;AAGtC,SAAS,sBAAsB,KAAsB;CACpD,MAAM,OAAO,eAAe,QAAQ,IAAI,UAAU;CAClD,MAAM,QACL,eAAe,SAAS,IAAI,iBAAiB,QAC1C,IAAI,MAAM,UACV,eAAe,SAAS,OAAO,IAAI,UAAU,WAC5C,IAAI,QACJ;CACL,MAAM,SAAS,QAAQ,KAAK,MAAM,KAAK;AACvC,KAAI,kBAAkB,KAAK,KAAK,IAAI,KAAK,SAAS,eAAe,CAChE,QACC,yBAAyB,OAAO;AAKlC,QAAO;;AAIR,MAAM,kBAA0D;CAC9D,eAAe;CACf,WAAW;CACX,cAAc;CACd,aAAa;CACb,kBAAkB;CAClB,qBAAqBA;CACrB,sBAAsBC;CACtB,gBAAgB;CACjB;AAsBD,MAAM,gCAAgB,IAAI,KAA2B;AACrD,MAAM,iBAAiB,MAAU;AAGjC,kBAAkB;CAChB,MAAM,MAAM,KAAK,KAAK;AACtB,MAAK,MAAM,CAAC,IAAI,YAAY,cAAc,SAAS,CACjD,KAAI,MAAM,QAAQ,WAAW;AAC3B,MAAI,QAAQ,gBACV,SAAQ,gBAAgB,OAAO;AAEjC,gBAAc,OAAO,GAAG;AACxB,MAAI,MAAM,EAAE,WAAW,IAAI,EAAE,mCAAmC;;GAGnE,KAAK,IAAK;AAEb,SAAS,oBAA4B;AACnC,QAAO,SAAS,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,UAAU,GAAG,GAAG;;AAG3E,SAAgB,wBAAwB,SAAyB;CAC/D,MAAM,QAAQ,IAAI,MAAM;;;;;AAMxB,OAAM,KAAK,UAAU,OAAO,MAAM;EAChC,MAAM,EAAE,aAAa,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;AAEzD,MAAI,CAAC,SACH,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;EAGvD,MAAM,gBAAgB,gBAAgB;AACtC,MAAI,CAAC,cACH,QAAO,EAAE,KAAK,EAAE,OAAO,2BAA2B,YAAY,EAAE,IAAI;EAGtE,MAAM,YAAY,mBAAmB;EACrC,MAAM,UAAwB;GAC5B,IAAI;GACJ;GACA,QAAQ;GACR,WAAW,KAAK,KAAK;GACrB,WAAW,KAAK,KAAK,GAAG;GACzB;AAED,gBAAc,IAAI,WAAW,QAAQ;AAGrC,eAAa,SAAS,eAAe,QAAQ,CAAC,OAAM,QAAO;AACzD,OAAI,MAAM;IAAE;IAAW;IAAU,OAAO;IAAK,EAAE,+BAA+B;AAC9E,WAAQ,SAAS;AACjB,WAAQ,QAAQ,eAAe,QAAQ,IAAI,UAAU;IACrD;AAEF,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP;IACA;IACA,QAAQ,QAAQ;IACjB;GACF,CAAC;GACF;;;;;AAMF,OAAM,IAAI,uBAAuB,MAAM;EACrC,MAAM,YAAY,EAAE,IAAI,MAAM,YAAY;EAC1C,MAAM,UAAU,cAAc,IAAI,UAAU;AAE5C,MAAI,CAAC,QACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;AAGpD,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,WAAW,QAAQ;IACnB,UAAU,QAAQ;IAClB,QAAQ,QAAQ;IAChB,SAAS,QAAQ;IACjB,cAAc,QAAQ;IACtB,YAAY,QAAQ;IACpB,iBAAiB,QAAQ;IACzB,SAAS,QAAQ;IACjB,OAAO,QAAQ;IACf,WAAW,QAAQ;IACpB;GACF,CAAC;GACF;;;;;AAMF,OAAM,KAAK,oBAAoB,OAAO,MAAM;EAC1C,MAAM,YAAY,EAAE,IAAI,MAAM,YAAY;EAC1C,MAAM,EAAE,SAAS,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;AAErD,MAAI,CAAC,KACH,QAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,EAAE,IAAI;EAGnD,MAAM,UAAU,cAAc,IAAI,UAAU;AAC5C,MAAI,CAAC,QACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;AAGpD,MAAI,QAAQ,WAAW,kBAAkB,CAAC,QAAQ,kBAChD,QAAO,EAAE,KAAK,EAAE,OAAO,mCAAmC,EAAE,IAAI;AAIlE,UAAQ,kBAAkB,KAAK;AAC/B,UAAQ,oBAAoB,KAAA;AAC5B,UAAQ,mBAAmB,KAAA;AAE3B,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS,EACP,SAAS,iCACV;GACF,CAAC;GACF;;;;;AAMF,OAAM,KAAK,sBAAsB,OAAO,MAAM;EAC5C,MAAM,YAAY,EAAE,IAAI,MAAM,YAAY;EAC1C,MAAM,UAAU,cAAc,IAAI,UAAU;AAE5C,MAAI,CAAC,QACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;AAGpD,MAAI,QAAQ,gBACV,SAAQ,gBAAgB,OAAO;AAGjC,MAAI,QAAQ,kBAAkB;AAC5B,WAAQ,iCAAiB,IAAI,MAAM,0BAA0B,CAAC;AAC9D,WAAQ,mBAAmB,KAAA;AAC3B,WAAQ,oBAAoB,KAAA;;AAG9B,UAAQ,SAAS;AACjB,UAAQ,UAAU;AAElB,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS,EACP,SAAS,wBACV;GACF,CAAC;GACF;;;;;AAMF,OAAM,OAAO,gBAAgB,MAAM;EACjC,MAAM,YAAY,EAAE,IAAI,MAAM,YAAY;AAE1C,MAAI,cAAc,IAAI,UAAU,EAAE;GAChC,MAAM,UAAU,cAAc,IAAI,UAAU;AAC5C,OAAI,QAAQ,gBACV,SAAQ,gBAAgB,OAAO;AAEjC,iBAAc,OAAO,UAAU;;AAGjC,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,QAAO;;;;;AAMT,eAAe,aACb,SACA,eACA,UACe;CACf,MAAM,kBAAkB,IAAI,iBAAiB;AAC7C,SAAQ,kBAAkB;CAE1B,IAAI,oBAA4C;CAChD,IAAI;CACJ,IAAI;CAEJ,MAAM,YAAiC;EACrC,SAAS,SAAiD;AACxD,WAAQ,UAAU,KAAK;AACvB,WAAQ,eAAe,KAAK;AAE5B,OAAI,cAAc,oBAAoB;AAEpC,YAAQ,SAAS;AACjB,YAAQ,UAAU;AAClB,wBAAoB,IAAI,SAAS,SAAS,WAAW;AACnD,yBAAoB;AACpB,wBAAmB;MACnB;AACF,YAAQ,oBAAoB;AAC5B,YAAQ,mBAAmB;UACtB;AACL,YAAQ,SAAS;AACjB,YAAQ,UAAU;;;EAGtB,UAAU,OAAO,WAA+E;AAC9F,WAAQ,SAAS;AACjB,WAAQ,aAAa,OAAO;AAC5B,WAAQ,kBAAkB,OAAO;AACjC,WAAQ,UAAU,OAAO;AAGzB,uBAAoB,IAAI,SAAS,SAAS,WAAW;AACnD,wBAAoB;AACpB,uBAAmB;KACnB;AACF,WAAQ,oBAAoB;AAC5B,WAAQ,mBAAmB;AAG3B,UAAO;;EAET,aAAa,YAAoB;AAC/B,OAAI,MAAM;IAAE,WAAW,QAAQ;IAAI;IAAS,EAAE,iBAAiB;AAC/D,WAAQ,UAAU;;EAEpB,mBAAmB,YAAY;AAE7B,OAAI,kBACF,QAAO;AAET,UAAO;;EAET,QAAQ,gBAAgB;EACzB;AAED,KAAI;EACF,MAAM,cAAc,MAAM,cAAc,MAAM,UAAU;AAGxD,6BAA2B,QAAQ,UAAU,YAAY;EAGzD,MAAM,SAAS,cAAc,UAAU,YAAY;AAInD,QAAM,IADe,oBACP,CAAC,WAAW,QAAQ,UAAU,QAAQ,EAAE,aAAa,WAAW,CAAC;AAE/E,UAAQ,SAAS;AACjB,UAAQ,cAAc;AACtB,UAAQ,UAAU;AAElB,MAAI,KAAK;GAAE,WAAW,QAAQ;GAAI,UAAU,QAAQ;GAAU,EAAE,wBAAwB;UACjF,KAAK;AACZ,MAAI,gBAAgB,OAAO,SAAS;AAClC,WAAQ,SAAS;AACjB,WAAQ,UAAU;SACb;AACL,WAAQ,SAAS;AACjB,WAAQ,QAAQ,sBAAsB,IAAI;AAC1C,OAAI,MAAM;IAAE,WAAW,QAAQ;IAAI,UAAU,QAAQ;IAAU,OAAO;IAAK,EAAE,qBAAqB;;WAE5F;AACR,UAAQ,kBAAkB,KAAA;AAC1B,UAAQ,oBAAoB,KAAA;AAC5B,UAAQ,mBAAmB,KAAA;;;AAK/B,MAAM,wCAAuD,IAAI,KAAK;AAEtE,SAAgB,6BAA6B,UAAgD;AAC3F,QAAO,sBAAsB,IAAI,SAAS;;AAG5C,SAAgB,2BAA2B,UAAkB,OAA+B;AAC1F,uBAAsB,IAAI,UAAU,MAAM;;AAG5C,SAAgB,gCAAgC,UAAwB;AACtE,uBAAsB,OAAO,SAAS"}
+{"version":3,"file":"oauth-async.js","names":["googleGeminiCliOAuthProvider","googleAntigravityOAuthProvider"],"sources":["../../../../src/gateway/hono/oauth-async.ts"],"sourcesContent":["/**\n * Async OAuth Handler\n * \n * Provides non-blocking OAuth flow with session-based state management.\n * This allows OAuth flows that require user interaction (browser login) \n * without blocking the HTTP request.\n */\n\nimport { Hono } from 'hono';\nimport type { GatewayService } from '../service.js';\nimport { \n  type OAuthProviderInterface, \n  type OAuthLoginCallbacks,\n  type OAuthCredentials \n} from '../../auth/oauth/types.js';\nimport {\n  kimiCodingOAuthProvider,\n  minimaxOAuthProvider,\n  minimaxCnOAuthProvider,\n  anthropicOAuthProvider,\n  githubCopilotOAuthProvider,\n  googleGeminiCliOAuthProvider,\n  googleAntigravityOAuthProvider,\n  openaiCodexOAuthProvider,\n} from '../../auth/oauth/index.js';\nimport { createLogger } from '../../utils/logger.js';\nimport { CredentialResolver } from '../../auth/credentials.js';\n\nconst log = createLogger('OAuthAsync');\n\n/** User-facing message when undici/fetch fails (often DNS, firewall, or wrong machine for localhost callback). */\nfunction formatOAuthAsyncError(err: unknown): string {\n\tconst base = err instanceof Error ? err.message : 'OAuth login failed';\n\tconst cause =\n\t\terr instanceof Error && err.cause instanceof Error\n\t\t\t? err.cause.message\n\t\t\t: err instanceof Error && typeof err.cause === 'string'\n\t\t\t\t? err.cause\n\t\t\t\t: '';\n\tconst detail = cause ? ` (${cause})` : '';\n\tif (/^fetch failed$/i.test(base) || base.includes('fetch failed')) {\n\t\treturn (\n\t\t\t`Network request failed${detail}. If the browser opened on another device, the redirect goes to that device's localhost — ` +\n\t\t\t`copy the full URL from the browser address bar after sign-in (starts with http://127.0.0.1 or http://localhost) and paste it below. ` +\n\t\t\t`Otherwise check VPN/proxy/DNS/firewall access to Google OAuth.`\n\t\t);\n\t}\n\treturn base;\n}\n\n// Static OAuth providers map\nconst OAUTH_PROVIDERS: Record<string, OAuthProviderInterface> = {\n  'kimi-coding': kimiCodingOAuthProvider,\n  'minimax': minimaxOAuthProvider,\n  'minimax-cn': minimaxCnOAuthProvider,\n  'anthropic': anthropicOAuthProvider,\n  'github-copilot': githubCopilotOAuthProvider,\n  'google-gemini-cli': googleGeminiCliOAuthProvider,\n  'google-antigravity': googleAntigravityOAuthProvider,\n  'openai-codex': openaiCodexOAuthProvider,\n};\n\n// OAuth session state\ninterface OAuthSession {\n  id: string;\n  provider: string;\n  status: 'pending' | 'waiting_auth' | 'waiting_code' | 'completed' | 'failed' | 'cancelled';\n  authUrl?: string;\n  instructions?: string;\n  deviceCode?: string;\n  verificationUri?: string;\n  message?: string;\n  error?: string;\n  credentials?: OAuthCredentials;\n  createdAt: number;\n  expiresAt: number;\n  abortController?: AbortController;\n  manualCodeResolve?: (code: string) => void;\n  manualCodeReject?: (error: Error) => void;\n}\n\n// In-memory session store (could be moved to Redis for production)\nconst oauthSessions = new Map<string, OAuthSession>();\nconst SESSION_TTL_MS = 10 * 60 * 1000; // 10 minutes\n\n// Clean up expired sessions periodically\nsetInterval(() => {\n  const now = Date.now();\n  for (const [id, session] of oauthSessions.entries()) {\n    if (now > session.expiresAt) {\n      cancelOAuthSession(session, 'OAuth flow expired');\n      oauthSessions.delete(id);\n      log.debug({ sessionId: id }, 'Cleaned up expired OAuth session');\n    }\n  }\n}, 60 * 1000);\n\nfunction generateSessionId(): string {\n  return `oauth_${Date.now()}_${Math.random().toString(36).substring(2, 15)}`;\n}\n\nfunction cancelOAuthSession(session: OAuthSession, message = 'OAuth flow cancelled'): void {\n  if (session.abortController) {\n    session.abortController.abort();\n  }\n\n  if (session.manualCodeResolve) {\n    session.manualCodeResolve('');\n  }\n\n  session.manualCodeResolve = undefined;\n  session.manualCodeReject = undefined;\n  session.status = 'cancelled';\n  session.message = message;\n}\n\nexport function createOAuthAsyncHandler(service: GatewayService) {\n  const oauth = new Hono();\n\n  /**\n   * POST /api/auth/oauth-async/start\n   * Start async OAuth flow - returns immediately with session ID\n   */\n  oauth.post('/start', async (c) => {\n    const { provider } = await c.req.json().catch(() => ({}));\n    \n    if (!provider) {\n      return c.json({ error: 'Provider is required' }, 400);\n    }\n\n    const oauthProvider = OAUTH_PROVIDERS[provider];\n    if (!oauthProvider) {\n      return c.json({ error: `Unknown OAuth provider: ${provider}` }, 400);\n    }\n\n    const sessionId = generateSessionId();\n    const session: OAuthSession = {\n      id: sessionId,\n      provider,\n      status: 'pending',\n      createdAt: Date.now(),\n      expiresAt: Date.now() + SESSION_TTL_MS,\n    };\n\n    oauthSessions.set(sessionId, session);\n\n    // Start OAuth flow in background\n    runOAuthFlow(session, oauthProvider, service).catch(err => {\n      log.error({ sessionId, provider, error: err }, 'Background OAuth flow failed');\n      session.status = 'failed';\n      session.error = err instanceof Error ? err.message : 'OAuth flow failed';\n    });\n\n    return c.json({ \n      ok: true, \n      payload: { \n        sessionId,\n        provider,\n        status: session.status,\n      } \n    });\n  });\n\n  /**\n   * GET /api/auth/oauth-async/:sessionId/status\n   * Check OAuth session status\n   */\n  oauth.get('/:sessionId/status', (c) => {\n    const sessionId = c.req.param('sessionId');\n    const session = oauthSessions.get(sessionId);\n\n    if (!session) {\n      return c.json({ error: 'Session not found' }, 404);\n    }\n\n    return c.json({ \n      ok: true, \n      payload: { \n        sessionId: session.id,\n        provider: session.provider,\n        status: session.status,\n        authUrl: session.authUrl,\n        instructions: session.instructions,\n        deviceCode: session.deviceCode,\n        verificationUri: session.verificationUri,\n        message: session.message,\n        error: session.error,\n        expiresAt: session.expiresAt,\n      } \n    });\n  });\n\n  /**\n   * POST /api/auth/oauth-async/:sessionId/code\n   * Submit manual authorization code\n   */\n  oauth.post('/:sessionId/code', async (c) => {\n    const sessionId = c.req.param('sessionId');\n    const { code } = await c.req.json().catch(() => ({}));\n    \n    if (!code) {\n      return c.json({ error: 'Code is required' }, 400);\n    }\n\n    const session = oauthSessions.get(sessionId);\n    if (!session) {\n      return c.json({ error: 'Session not found' }, 404);\n    }\n\n    if (session.status !== 'waiting_code' || !session.manualCodeResolve) {\n      return c.json({ error: 'Session is not waiting for code' }, 400);\n    }\n\n    // Resolve the manual code promise\n    session.manualCodeResolve(code);\n    session.manualCodeResolve = undefined;\n    session.manualCodeReject = undefined;\n\n    return c.json({ \n      ok: true, \n      payload: { \n        message: 'Code submitted, processing...',\n      } \n    });\n  });\n\n  /**\n   * POST /api/auth/oauth-async/:sessionId/cancel\n   * Cancel OAuth flow\n   */\n  oauth.post('/:sessionId/cancel', async (c) => {\n    const sessionId = c.req.param('sessionId');\n    const session = oauthSessions.get(sessionId);\n\n    if (!session) {\n      return c.json({ error: 'Session not found' }, 404);\n    }\n\n    cancelOAuthSession(session);\n\n    return c.json({ \n      ok: true, \n      payload: { \n        message: 'OAuth flow cancelled',\n      } \n    });\n  });\n\n  /**\n   * DELETE /api/auth/oauth-async/:sessionId\n   * Clean up OAuth session\n   */\n  oauth.delete('/:sessionId', (c) => {\n    const sessionId = c.req.param('sessionId');\n    \n    if (oauthSessions.has(sessionId)) {\n      const session = oauthSessions.get(sessionId)!;\n      cancelOAuthSession(session);\n      oauthSessions.delete(sessionId);\n    }\n\n    return c.json({ ok: true });\n  });\n\n  return oauth;\n}\n\n/**\n * Run OAuth flow in background\n */\nasync function runOAuthFlow(\n  session: OAuthSession,\n  oauthProvider: OAuthProviderInterface,\n  _service: GatewayService\n): Promise<void> {\n  const abortController = new AbortController();\n  session.abortController = abortController;\n\n  let manualCodePromise: Promise<string> | null = null;\n  let manualCodeResolve: ((code: string) => void) | undefined;\n  let manualCodeReject: ((error: Error) => void) | undefined;\n\n  const callbacks: OAuthLoginCallbacks = {\n    onAuth: (auth: { url: string; instructions?: string }) => {\n      session.authUrl = auth.url;\n      session.instructions = auth.instructions;\n      \n      if (oauthProvider.usesCallbackServer) {\n        // For callback server providers, prepare for manual code input\n        session.status = 'waiting_code';\n        session.message = 'Complete authorization in browser, or paste the redirect URL below';\n        manualCodePromise = new Promise((resolve, reject) => {\n          manualCodeResolve = resolve;\n          manualCodeReject = reject;\n        });\n        session.manualCodeResolve = manualCodeResolve;\n        session.manualCodeReject = manualCodeReject;\n      } else {\n        session.status = 'waiting_auth';\n        session.message = 'Complete authorization in browser';\n      }\n    },\n    onDeviceCode: (info) => {\n      session.status = 'waiting_auth';\n      session.authUrl = info.verificationUri;\n      session.deviceCode = info.userCode;\n      session.verificationUri = info.verificationUri;\n      session.instructions = `Enter code ${info.userCode}`;\n      session.message = `Open ${info.verificationUri} and enter code ${info.userCode}`;\n    },\n    onPrompt: async (prompt: { message: string; deviceCode?: string; verificationUri?: string }) => {\n      session.status = 'waiting_code';\n      session.deviceCode = prompt.deviceCode;\n      session.verificationUri = prompt.verificationUri;\n      session.message = prompt.message;\n      \n      // For device code flow, wait for manual input\n      manualCodePromise = new Promise((resolve, reject) => {\n        manualCodeResolve = resolve;\n        manualCodeReject = reject;\n      });\n      session.manualCodeResolve = manualCodeResolve;\n      session.manualCodeReject = manualCodeReject;\n      \n      // Return empty for now, will be resolved by manual code submission\n      return '';\n    },\n    onProgress: (message: string) => {\n      log.debug({ sessionId: session.id, message }, 'OAuth progress');\n      session.message = message;\n    },\n    onManualCodeInput: async () => {\n      // Return the manual code promise for callback server providers\n      if (manualCodePromise) {\n        return manualCodePromise;\n      }\n      return '';\n    },\n    onSelect: async (prompt) => {\n      const browserOption = prompt.options.find((option) => option.id === 'browser');\n      const firstOption = prompt.options[0];\n      const selectedOption = browserOption ?? firstOption;\n      if (!selectedOption) {\n        throw new Error('OAuth login did not provide any selectable auth method');\n      }\n      log.debug(\n        { sessionId: session.id, provider: session.provider, selected: selectedOption.id },\n        'Selected OAuth auth method',\n      );\n      return selectedOption.id;\n    },\n    signal: abortController.signal,\n  };\n\n  try {\n    const credentials = await oauthProvider.login(callbacks);\n    \n    // Save credentials to cache and persist them as first-class OAuth credentials.\n    setOAuthCredentialsToCache(session.provider, credentials);\n\n    const resolver = new CredentialResolver();\n    await resolver.saveOAuthToken(session.provider, {\n      access: oauthProvider.getApiKey(credentials),\n      refresh: credentials.refresh,\n      expiresAt: credentials.expires,\n      scope: Array.isArray(credentials.scope) ? credentials.scope.filter((value): value is string => typeof value === 'string') : undefined,\n      createdAt: new Date().toISOString(),\n    });\n\n    session.status = 'completed';\n    session.credentials = credentials;\n    session.message = 'OAuth login successful';\n    \n    log.info({ sessionId: session.id, provider: session.provider }, 'OAuth login completed');\n  } catch (err) {\n    if (abortController.signal.aborted || session.status === 'cancelled') {\n      session.status = 'cancelled';\n      session.message ??= 'OAuth flow cancelled by user';\n    } else {\n      session.status = 'failed';\n      session.error = formatOAuthAsyncError(err);\n      log.error({ sessionId: session.id, provider: session.provider, error: err }, 'OAuth login failed');\n    }\n  } finally {\n    session.abortController = undefined;\n    session.manualCodeResolve = undefined;\n    session.manualCodeReject = undefined;\n  }\n}\n\n// Simple in-memory cache for OAuth credentials\nconst oauthCredentialsCache: Map<string, OAuthCredentials> = new Map();\n\nexport function getOAuthCredentialsFromCache(provider: string): OAuthCredentials | undefined {\n  return oauthCredentialsCache.get(provider);\n}\n\nexport function setOAuthCredentialsToCache(provider: string, creds: OAuthCredentials): void {\n  oauthCredentialsCache.set(provider, creds);\n}\n\nexport function deleteOAuthCredentialsFromCache(provider: string): void {\n  oauthCredentialsCache.delete(provider);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;aAyBqD;kBACU;AAE/D,MAAM,MAAM,aAAa,aAAa;;AAGtC,SAAS,sBAAsB,KAAsB;CACpD,MAAM,OAAO,eAAe,QAAQ,IAAI,UAAU;CAClD,MAAM,QACL,eAAe,SAAS,IAAI,iBAAiB,QAC1C,IAAI,MAAM,UACV,eAAe,SAAS,OAAO,IAAI,UAAU,WAC5C,IAAI,QACJ;CACL,MAAM,SAAS,QAAQ,KAAK,MAAM,KAAK;AACvC,KAAI,kBAAkB,KAAK,KAAK,IAAI,KAAK,SAAS,eAAe,CAChE,QACC,yBAAyB,OAAO;AAKlC,QAAO;;AAIR,MAAM,kBAA0D;CAC9D,eAAe;CACf,WAAW;CACX,cAAc;CACd,aAAa;CACb,kBAAkB;CAClB,qBAAqBA;CACrB,sBAAsBC;CACtB,gBAAgB;CACjB;AAsBD,MAAM,gCAAgB,IAAI,KAA2B;AACrD,MAAM,iBAAiB,MAAU;AAGjC,kBAAkB;CAChB,MAAM,MAAM,KAAK,KAAK;AACtB,MAAK,MAAM,CAAC,IAAI,YAAY,cAAc,SAAS,CACjD,KAAI,MAAM,QAAQ,WAAW;AAC3B,qBAAmB,SAAS,qBAAqB;AACjD,gBAAc,OAAO,GAAG;AACxB,MAAI,MAAM,EAAE,WAAW,IAAI,EAAE,mCAAmC;;GAGnE,KAAK,IAAK;AAEb,SAAS,oBAA4B;AACnC,QAAO,SAAS,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,UAAU,GAAG,GAAG;;AAG3E,SAAS,mBAAmB,SAAuB,UAAU,wBAA8B;AACzF,KAAI,QAAQ,gBACV,SAAQ,gBAAgB,OAAO;AAGjC,KAAI,QAAQ,kBACV,SAAQ,kBAAkB,GAAG;AAG/B,SAAQ,oBAAoB,KAAA;AAC5B,SAAQ,mBAAmB,KAAA;AAC3B,SAAQ,SAAS;AACjB,SAAQ,UAAU;;AAGpB,SAAgB,wBAAwB,SAAyB;CAC/D,MAAM,QAAQ,IAAI,MAAM;;;;;AAMxB,OAAM,KAAK,UAAU,OAAO,MAAM;EAChC,MAAM,EAAE,aAAa,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;AAEzD,MAAI,CAAC,SACH,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;EAGvD,MAAM,gBAAgB,gBAAgB;AACtC,MAAI,CAAC,cACH,QAAO,EAAE,KAAK,EAAE,OAAO,2BAA2B,YAAY,EAAE,IAAI;EAGtE,MAAM,YAAY,mBAAmB;EACrC,MAAM,UAAwB;GAC5B,IAAI;GACJ;GACA,QAAQ;GACR,WAAW,KAAK,KAAK;GACrB,WAAW,KAAK,KAAK,GAAG;GACzB;AAED,gBAAc,IAAI,WAAW,QAAQ;AAGrC,eAAa,SAAS,eAAe,QAAQ,CAAC,OAAM,QAAO;AACzD,OAAI,MAAM;IAAE;IAAW;IAAU,OAAO;IAAK,EAAE,+BAA+B;AAC9E,WAAQ,SAAS;AACjB,WAAQ,QAAQ,eAAe,QAAQ,IAAI,UAAU;IACrD;AAEF,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP;IACA;IACA,QAAQ,QAAQ;IACjB;GACF,CAAC;GACF;;;;;AAMF,OAAM,IAAI,uBAAuB,MAAM;EACrC,MAAM,YAAY,EAAE,IAAI,MAAM,YAAY;EAC1C,MAAM,UAAU,cAAc,IAAI,UAAU;AAE5C,MAAI,CAAC,QACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;AAGpD,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,WAAW,QAAQ;IACnB,UAAU,QAAQ;IAClB,QAAQ,QAAQ;IAChB,SAAS,QAAQ;IACjB,cAAc,QAAQ;IACtB,YAAY,QAAQ;IACpB,iBAAiB,QAAQ;IACzB,SAAS,QAAQ;IACjB,OAAO,QAAQ;IACf,WAAW,QAAQ;IACpB;GACF,CAAC;GACF;;;;;AAMF,OAAM,KAAK,oBAAoB,OAAO,MAAM;EAC1C,MAAM,YAAY,EAAE,IAAI,MAAM,YAAY;EAC1C,MAAM,EAAE,SAAS,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;AAErD,MAAI,CAAC,KACH,QAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,EAAE,IAAI;EAGnD,MAAM,UAAU,cAAc,IAAI,UAAU;AAC5C,MAAI,CAAC,QACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;AAGpD,MAAI,QAAQ,WAAW,kBAAkB,CAAC,QAAQ,kBAChD,QAAO,EAAE,KAAK,EAAE,OAAO,mCAAmC,EAAE,IAAI;AAIlE,UAAQ,kBAAkB,KAAK;AAC/B,UAAQ,oBAAoB,KAAA;AAC5B,UAAQ,mBAAmB,KAAA;AAE3B,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS,EACP,SAAS,iCACV;GACF,CAAC;GACF;;;;;AAMF,OAAM,KAAK,sBAAsB,OAAO,MAAM;EAC5C,MAAM,YAAY,EAAE,IAAI,MAAM,YAAY;EAC1C,MAAM,UAAU,cAAc,IAAI,UAAU;AAE5C,MAAI,CAAC,QACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;AAGpD,qBAAmB,QAAQ;AAE3B,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS,EACP,SAAS,wBACV;GACF,CAAC;GACF;;;;;AAMF,OAAM,OAAO,gBAAgB,MAAM;EACjC,MAAM,YAAY,EAAE,IAAI,MAAM,YAAY;AAE1C,MAAI,cAAc,IAAI,UAAU,EAAE;AAEhC,sBADgB,cAAc,IAAI,UACR,CAAC;AAC3B,iBAAc,OAAO,UAAU;;AAGjC,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,QAAO;;;;;AAMT,eAAe,aACb,SACA,eACA,UACe;CACf,MAAM,kBAAkB,IAAI,iBAAiB;AAC7C,SAAQ,kBAAkB;CAE1B,IAAI,oBAA4C;CAChD,IAAI;CACJ,IAAI;CAEJ,MAAM,YAAiC;EACrC,SAAS,SAAiD;AACxD,WAAQ,UAAU,KAAK;AACvB,WAAQ,eAAe,KAAK;AAE5B,OAAI,cAAc,oBAAoB;AAEpC,YAAQ,SAAS;AACjB,YAAQ,UAAU;AAClB,wBAAoB,IAAI,SAAS,SAAS,WAAW;AACnD,yBAAoB;AACpB,wBAAmB;MACnB;AACF,YAAQ,oBAAoB;AAC5B,YAAQ,mBAAmB;UACtB;AACL,YAAQ,SAAS;AACjB,YAAQ,UAAU;;;EAGtB,eAAe,SAAS;AACtB,WAAQ,SAAS;AACjB,WAAQ,UAAU,KAAK;AACvB,WAAQ,aAAa,KAAK;AAC1B,WAAQ,kBAAkB,KAAK;AAC/B,WAAQ,eAAe,cAAc,KAAK;AAC1C,WAAQ,UAAU,QAAQ,KAAK,gBAAgB,kBAAkB,KAAK;;EAExE,UAAU,OAAO,WAA+E;AAC9F,WAAQ,SAAS;AACjB,WAAQ,aAAa,OAAO;AAC5B,WAAQ,kBAAkB,OAAO;AACjC,WAAQ,UAAU,OAAO;AAGzB,uBAAoB,IAAI,SAAS,SAAS,WAAW;AACnD,wBAAoB;AACpB,uBAAmB;KACnB;AACF,WAAQ,oBAAoB;AAC5B,WAAQ,mBAAmB;AAG3B,UAAO;;EAET,aAAa,YAAoB;AAC/B,OAAI,MAAM;IAAE,WAAW,QAAQ;IAAI;IAAS,EAAE,iBAAiB;AAC/D,WAAQ,UAAU;;EAEpB,mBAAmB,YAAY;AAE7B,OAAI,kBACF,QAAO;AAET,UAAO;;EAET,UAAU,OAAO,WAAW;GAC1B,MAAM,gBAAgB,OAAO,QAAQ,MAAM,WAAW,OAAO,OAAO,UAAU;GAC9E,MAAM,cAAc,OAAO,QAAQ;GACnC,MAAM,iBAAiB,iBAAiB;AACxC,OAAI,CAAC,eACH,OAAM,IAAI,MAAM,yDAAyD;AAE3E,OAAI,MACF;IAAE,WAAW,QAAQ;IAAI,UAAU,QAAQ;IAAU,UAAU,eAAe;IAAI,EAClF,6BACD;AACD,UAAO,eAAe;;EAExB,QAAQ,gBAAgB;EACzB;AAED,KAAI;EACF,MAAM,cAAc,MAAM,cAAc,MAAM,UAAU;AAGxD,6BAA2B,QAAQ,UAAU,YAAY;AAGzD,QAAM,IADe,oBACP,CAAC,eAAe,QAAQ,UAAU;GAC9C,QAAQ,cAAc,UAAU,YAAY;GAC5C,SAAS,YAAY;GACrB,WAAW,YAAY;GACvB,OAAO,MAAM,QAAQ,YAAY,MAAM,GAAG,YAAY,MAAM,QAAQ,UAA2B,OAAO,UAAU,SAAS,GAAG,KAAA;GAC5H,4BAAW,IAAI,MAAM,EAAC,aAAa;GACpC,CAAC;AAEF,UAAQ,SAAS;AACjB,UAAQ,cAAc;AACtB,UAAQ,UAAU;AAElB,MAAI,KAAK;GAAE,WAAW,QAAQ;GAAI,UAAU,QAAQ;GAAU,EAAE,wBAAwB;UACjF,KAAK;AACZ,MAAI,gBAAgB,OAAO,WAAW,QAAQ,WAAW,aAAa;AACpE,WAAQ,SAAS;AACjB,WAAQ,YAAY;SACf;AACL,WAAQ,SAAS;AACjB,WAAQ,QAAQ,sBAAsB,IAAI;AAC1C,OAAI,MAAM;IAAE,WAAW,QAAQ;IAAI,UAAU,QAAQ;IAAU,OAAO;IAAK,EAAE,qBAAqB;;WAE5F;AACR,UAAQ,kBAAkB,KAAA;AAC1B,UAAQ,oBAAoB,KAAA;AAC5B,UAAQ,mBAAmB,KAAA;;;AAK/B,MAAM,wCAAuD,IAAI,KAAK;AAEtE,SAAgB,6BAA6B,UAAgD;AAC3F,QAAO,sBAAsB,IAAI,SAAS;;AAG5C,SAAgB,2BAA2B,UAAkB,OAA+B;AAC1F,uBAAsB,IAAI,UAAU,MAAM;;AAG5C,SAAgB,gCAAgC,UAAwB;AACtE,uBAAsB,OAAO,SAAS"}

package/dist/src/gateway/hono/oauth.js

@@ -1,6 +1,6 @@
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { anthropicOAuthProvider } from "../../auth/oauth/anthropic.js";
-import { init_providers, isProviderConfigured } from "../../providers/index.js";
+import { getProviderAuthState, init_providers, isProviderConfigured } from "../../providers/index.js";
 import { minimaxOAuthProvider } from "../../auth/oauth/minimax.js";
 import { minimaxCnOAuthProvider } from "../../auth/oauth/minimax-cn.js";
 import { kimiCodingOAuthProvider } from "../../auth/oauth/kimi-coding.js";
@@ -61,6 +61,15 @@ function createOAuthHandler(_service) {
 						instructions: auth.instructions
 					};
 				},
+				onDeviceCode: (info) => {
+					authResult = {
+						url: info.verificationUri,
+						instructions: `Enter code ${info.userCode}`,
+						message: `Open ${info.verificationUri} and enter code ${info.userCode}`,
+						deviceCode: info.userCode,
+						verificationUri: info.verificationUri
+					};
+				},
 				onPrompt: async (prompt) => {
 					authResult = {
 						message: prompt.message,
@@ -75,11 +84,19 @@ function createOAuthHandler(_service) {
 				onManualCodeInput: async () => {
 					manualCodeRequested = true;
 					return "";
+				},
+				onSelect: async (prompt) => {
+					return prompt.options.find((option) => option.id === "browser")?.id ?? prompt.options[0]?.id;
 				}
 			});
 			setOAuthCredentialsToCache(provider, credentials);
-			const apiKey = oauthProvider.getApiKey(credentials);
-			await new CredentialResolver().saveApiKey(provider, apiKey, { profileName: "default" });
+			await new CredentialResolver().saveOAuthToken(provider, {
+				access: oauthProvider.getApiKey(credentials),
+				refresh: credentials.refresh,
+				expiresAt: credentials.expires,
+				scope: Array.isArray(credentials.scope) ? credentials.scope.filter((value) => typeof value === "string") : void 0,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
+			});
 			return c.json({
 				ok: true,
 				payload: {
@@ -107,12 +124,15 @@ function createOAuthHandler(_service) {
 	oauth.get("/:provider", async (c) => {
 		const provider = c.req.param("provider");
 		const credentials = getOAuthCredentialsFromCache(provider);
+		const authState = await getProviderAuthState(provider);
 		const configured = await isProviderConfigured(provider);
 		return c.json({
 			ok: true,
 			payload: {
 				configured: configured || !!credentials,
-				expires: credentials?.expires
+				authMode: authState.authMode,
+				authStatus: authState.authStatus,
+				expiresAt: authState.expiresAt ?? credentials?.expires
 			}
 		});
 	});
@@ -121,8 +141,13 @@ function createOAuthHandler(_service) {
 	* Revoke OAuth credentials
 	*/
 	oauth.delete("/:provider", async (c) => {
-		deleteOAuthCredentialsFromCache(c.req.param("provider"));
-		return c.json({ ok: true });
+		const provider = c.req.param("provider");
+		deleteOAuthCredentialsFromCache(provider);
+		await new CredentialResolver().deleteProviderCredential(provider);
+		return c.json({
+			ok: true,
+			payload: { disconnected: provider }
+		});
 	});
 	/**
 	* GET /api/auth/oauth

package/dist/src/gateway/hono/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","names":["googleGeminiCliOAuthProvider","googleAntigravityOAuthProvider"],"sources":["../../../../src/gateway/hono/oauth.ts"],"sourcesContent":["/**\n * OAuth HTTP Handler\n * \n * Provides HTTP endpoints for OAuth login flow.\n */\n\nimport { Hono } from 'hono';\nimport type { GatewayService } from '../service.js';\nimport { \n  type OAuthProviderInterface, \n  type OAuthLoginCallbacks,\n  type OAuthCredentials \n} from '../../auth/oauth/types.js';\nimport {\n  kimiCodingOAuthProvider,\n  minimaxOAuthProvider,\n  minimaxCnOAuthProvider,\n  anthropicOAuthProvider,\n  githubCopilotOAuthProvider,\n  googleGeminiCliOAuthProvider,\n  googleAntigravityOAuthProvider,\n  openaiCodexOAuthProvider,\n} from '../../auth/oauth/index.js';\nimport { CredentialResolver } from '../../auth/credentials.js';\nimport { isProviderConfigured } from '../../providers/index.js';\n\n// Static OAuth providers map\nconst OAUTH_PROVIDERS: Record<string, OAuthProviderInterface> = {\n  'kimi-coding': kimiCodingOAuthProvider,\n  'minimax': minimaxOAuthProvider,\n  'minimax-cn': minimaxCnOAuthProvider,\n  'anthropic': anthropicOAuthProvider,\n  'github-copilot': githubCopilotOAuthProvider,\n  'google-gemini-cli': googleGeminiCliOAuthProvider,\n  'google-antigravity': googleAntigravityOAuthProvider,\n  'openai-codex': openaiCodexOAuthProvider,\n};\n\n// Simple in-memory cache for OAuth credentials\nconst oauthCredentialsCache: Map<string, OAuthCredentials> = new Map();\n\nfunction getOAuthCredentialsFromCache(provider: string): OAuthCredentials | undefined {\n  return oauthCredentialsCache.get(provider);\n}\n\nfunction setOAuthCredentialsToCache(provider: string, creds: OAuthCredentials): void {\n  oauthCredentialsCache.set(provider, creds);\n}\n\nfunction deleteOAuthCredentialsFromCache(provider: string): void {\n  oauthCredentialsCache.delete(provider);\n}\n\n/** No-op: OAuth tokens live on disk under auth paths; cache is populated during login. */\nexport function loadOAuthCredentialsToCache(_service: GatewayService): void {}\n\nexport function createOAuthHandler(_service: GatewayService) {\n  const oauth = new Hono();\n\n  /**\n   * POST /api/auth/oauth/start\n   * Start OAuth flow for a provider\n   */\n  oauth.post('/start', async (c) => {\n    const { provider } = await c.req.json().catch(() => ({}));\n    \n    if (!provider) {\n      return c.json({ error: 'Provider is required' }, 400);\n    }\n\n    const oauthProvider = OAUTH_PROVIDERS[provider];\n    if (!oauthProvider) {\n      return c.json({ error: `Unknown OAuth provider: ${provider}` }, 400);\n    }\n\n    try {\n      let authResult: any = null;\n      let manualCodeRequested = false;\n      \n      const callbacks: OAuthLoginCallbacks = {\n        onAuth: (auth: { url: string; instructions?: string }) => {\n          authResult = { url: auth.url, instructions: auth.instructions };\n        },\n        onPrompt: async (prompt: { message: string; deviceCode?: string; verificationUri?: string }) => {\n          authResult = { \n            message: prompt.message, \n            deviceCode: prompt.deviceCode,\n            verificationUri: prompt.verificationUri,\n          };\n          return prompt.deviceCode || '';\n        },\n        onProgress: (message: string) => {\n          console.log('OAuth progress:', message);\n        },\n        onManualCodeInput: async () => {\n          // For callback server providers, signal that manual code input is needed\n          manualCodeRequested = true;\n          // Return empty - frontend will handle manual input\n          return '';\n        },\n      };\n\n      const credentials = await oauthProvider.login(callbacks);\n      setOAuthCredentialsToCache(provider, credentials);\n\n      // Get API key from OAuth credentials\n      const apiKey = oauthProvider.getApiKey(credentials);\n\n      // Save API key to credential system\n      const resolver = new CredentialResolver();\n      await resolver.saveApiKey(provider, apiKey, { profileName: 'default' });\n\n      return c.json({ \n        ok: true, \n        payload: { \n          success: true,\n          provider,\n          message: 'OAuth login successful',\n          expires: credentials.expires,\n          authUrl: authResult?.url,\n          deviceCode: authResult?.deviceCode,\n          verificationUri: authResult?.verificationUri,\n          instructions: authResult?.instructions,\n          usesCallbackServer: oauthProvider.usesCallbackServer ?? false,\n          manualCodeRequested,\n        } \n      });\n    } catch (err) {\n      console.error('OAuth login error:', err);\n      return c.json({ \n        error: err instanceof Error ? err.message : 'OAuth login failed' \n      }, 500);\n    }\n  });\n\n  /**\n   * GET /api/auth/oauth/:provider\n   * Check OAuth status for a provider\n   */\n  oauth.get('/:provider', async (c) => {\n    const provider = c.req.param('provider');\n    const credentials = getOAuthCredentialsFromCache(provider);\n    const configured = await isProviderConfigured(provider);\n\n    return c.json({ \n      ok: true, \n      payload: { \n        configured: configured || !!credentials,\n        expires: credentials?.expires \n      } \n    });\n  });\n\n  /**\n   * DELETE /api/auth/oauth/:provider\n   * Revoke OAuth credentials\n   */\n  oauth.delete('/:provider', async (c) => {\n    const provider = c.req.param('provider');\n    \n    deleteOAuthCredentialsFromCache(provider);\n\n    return c.json({ ok: true });\n  });\n\n  /**\n   * GET /api/auth/oauth\n   * List available OAuth providers\n   */\n  oauth.get('/', (c) => {\n    const result = Object.entries(OAUTH_PROVIDERS).map(([id, p]) => ({\n      id,\n      name: p.name,\n    }));\n\n    return c.json({ ok: true, payload: { providers: result } });\n  });\n\n  return oauth;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;kBAuB+D;gBACC;AAGhE,MAAM,kBAA0D;CAC9D,eAAe;CACf,WAAW;CACX,cAAc;CACd,aAAa;CACb,kBAAkB;CAClB,qBAAqBA;CACrB,sBAAsBC;CACtB,gBAAgB;CACjB;AAGD,MAAM,wCAAuD,IAAI,KAAK;AAEtE,SAAS,6BAA6B,UAAgD;AACpF,QAAO,sBAAsB,IAAI,SAAS;;AAG5C,SAAS,2BAA2B,UAAkB,OAA+B;AACnF,uBAAsB,IAAI,UAAU,MAAM;;AAG5C,SAAS,gCAAgC,UAAwB;AAC/D,uBAAsB,OAAO,SAAS;;;AAIxC,SAAgB,4BAA4B,UAAgC;AAE5E,SAAgB,mBAAmB,UAA0B;CAC3D,MAAM,QAAQ,IAAI,MAAM;;;;;AAMxB,OAAM,KAAK,UAAU,OAAO,MAAM;EAChC,MAAM,EAAE,aAAa,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;AAEzD,MAAI,CAAC,SACH,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;EAGvD,MAAM,gBAAgB,gBAAgB;AACtC,MAAI,CAAC,cACH,QAAO,EAAE,KAAK,EAAE,OAAO,2BAA2B,YAAY,EAAE,IAAI;AAGtE,MAAI;GACF,IAAI,aAAkB;GACtB,IAAI,sBAAsB;GAyB1B,MAAM,cAAc,MAAM,cAAc,MAAM;IAtB5C,SAAS,SAAiD;AACxD,kBAAa;MAAE,KAAK,KAAK;MAAK,cAAc,KAAK;MAAc;;IAEjE,UAAU,OAAO,WAA+E;AAC9F,kBAAa;MACX,SAAS,OAAO;MAChB,YAAY,OAAO;MACnB,iBAAiB,OAAO;MACzB;AACD,YAAO,OAAO,cAAc;;IAE9B,aAAa,YAAoB;AAC/B,aAAQ,IAAI,mBAAmB,QAAQ;;IAEzC,mBAAmB,YAAY;AAE7B,2BAAsB;AAEtB,YAAO;;IAI4C,CAAC;AACxD,8BAA2B,UAAU,YAAY;GAGjD,MAAM,SAAS,cAAc,UAAU,YAAY;AAInD,SAAM,IADe,oBACP,CAAC,WAAW,UAAU,QAAQ,EAAE,aAAa,WAAW,CAAC;AAEvE,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP,SAAS;KACT;KACA,SAAS;KACT,SAAS,YAAY;KACrB,SAAS,YAAY;KACrB,YAAY,YAAY;KACxB,iBAAiB,YAAY;KAC7B,cAAc,YAAY;KAC1B,oBAAoB,cAAc,sBAAsB;KACxD;KACD;IACF,CAAC;WACK,KAAK;AACZ,WAAQ,MAAM,sBAAsB,IAAI;AACxC,UAAO,EAAE,KAAK,EACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,sBAC7C,EAAE,IAAI;;GAET;;;;;AAMF,OAAM,IAAI,cAAc,OAAO,MAAM;EACnC,MAAM,WAAW,EAAE,IAAI,MAAM,WAAW;EACxC,MAAM,cAAc,6BAA6B,SAAS;EAC1D,MAAM,aAAa,MAAM,qBAAqB,SAAS;AAEvD,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,YAAY,cAAc,CAAC,CAAC;IAC5B,SAAS,aAAa;IACvB;GACF,CAAC;GACF;;;;;AAMF,OAAM,OAAO,cAAc,OAAO,MAAM;AAGtC,kCAFiB,EAAE,IAAI,MAAM,WAEW,CAAC;AAEzC,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;;;;;AAMF,OAAM,IAAI,MAAM,MAAM;EACpB,MAAM,SAAS,OAAO,QAAQ,gBAAgB,CAAC,KAAK,CAAC,IAAI,QAAQ;GAC/D;GACA,MAAM,EAAE;GACT,EAAE;AAEH,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,WAAW,QAAQ;GAAE,CAAC;GAC3D;AAEF,QAAO"}
+{"version":3,"file":"oauth.js","names":["googleGeminiCliOAuthProvider","googleAntigravityOAuthProvider"],"sources":["../../../../src/gateway/hono/oauth.ts"],"sourcesContent":["/**\n * OAuth HTTP Handler\n * \n * Provides HTTP endpoints for OAuth login flow.\n */\n\nimport { Hono } from 'hono';\nimport type { GatewayService } from '../service.js';\nimport { \n  type OAuthProviderInterface, \n  type OAuthLoginCallbacks,\n  type OAuthCredentials \n} from '../../auth/oauth/types.js';\nimport {\n  kimiCodingOAuthProvider,\n  minimaxOAuthProvider,\n  minimaxCnOAuthProvider,\n  anthropicOAuthProvider,\n  githubCopilotOAuthProvider,\n  googleGeminiCliOAuthProvider,\n  googleAntigravityOAuthProvider,\n  openaiCodexOAuthProvider,\n} from '../../auth/oauth/index.js';\nimport { CredentialResolver } from '../../auth/credentials.js';\nimport { getProviderAuthState, isProviderConfigured } from '../../providers/index.js';\n\n// Static OAuth providers map\nconst OAUTH_PROVIDERS: Record<string, OAuthProviderInterface> = {\n  'kimi-coding': kimiCodingOAuthProvider,\n  'minimax': minimaxOAuthProvider,\n  'minimax-cn': minimaxCnOAuthProvider,\n  'anthropic': anthropicOAuthProvider,\n  'github-copilot': githubCopilotOAuthProvider,\n  'google-gemini-cli': googleGeminiCliOAuthProvider,\n  'google-antigravity': googleAntigravityOAuthProvider,\n  'openai-codex': openaiCodexOAuthProvider,\n};\n\n// Simple in-memory cache for OAuth credentials\nconst oauthCredentialsCache: Map<string, OAuthCredentials> = new Map();\n\nfunction getOAuthCredentialsFromCache(provider: string): OAuthCredentials | undefined {\n  return oauthCredentialsCache.get(provider);\n}\n\nfunction setOAuthCredentialsToCache(provider: string, creds: OAuthCredentials): void {\n  oauthCredentialsCache.set(provider, creds);\n}\n\nfunction deleteOAuthCredentialsFromCache(provider: string): void {\n  oauthCredentialsCache.delete(provider);\n}\n\n/** No-op: OAuth tokens live on disk under auth paths; cache is populated during login. */\nexport function loadOAuthCredentialsToCache(_service: GatewayService): void {}\n\nexport function createOAuthHandler(_service: GatewayService) {\n  const oauth = new Hono();\n\n  /**\n   * POST /api/auth/oauth/start\n   * Start OAuth flow for a provider\n   */\n  oauth.post('/start', async (c) => {\n    const { provider } = await c.req.json().catch(() => ({}));\n    \n    if (!provider) {\n      return c.json({ error: 'Provider is required' }, 400);\n    }\n\n    const oauthProvider = OAUTH_PROVIDERS[provider];\n    if (!oauthProvider) {\n      return c.json({ error: `Unknown OAuth provider: ${provider}` }, 400);\n    }\n\n    try {\n      let authResult: any = null;\n      let manualCodeRequested = false;\n      \n      const callbacks: OAuthLoginCallbacks = {\n        onAuth: (auth: { url: string; instructions?: string }) => {\n          authResult = { url: auth.url, instructions: auth.instructions };\n        },\n        onDeviceCode: (info) => {\n          authResult = {\n            url: info.verificationUri,\n            instructions: `Enter code ${info.userCode}`,\n            message: `Open ${info.verificationUri} and enter code ${info.userCode}`,\n            deviceCode: info.userCode,\n            verificationUri: info.verificationUri,\n          };\n        },\n        onPrompt: async (prompt: { message: string; deviceCode?: string; verificationUri?: string }) => {\n          authResult = { \n            message: prompt.message, \n            deviceCode: prompt.deviceCode,\n            verificationUri: prompt.verificationUri,\n          };\n          return prompt.deviceCode || '';\n        },\n        onProgress: (message: string) => {\n          console.log('OAuth progress:', message);\n        },\n        onManualCodeInput: async () => {\n          // For callback server providers, signal that manual code input is needed\n          manualCodeRequested = true;\n          // Return empty - frontend will handle manual input\n          return '';\n        },\n        onSelect: async (prompt) => {\n          const browserOption = prompt.options.find((option) => option.id === 'browser');\n          return browserOption?.id ?? prompt.options[0]?.id;\n        },\n      };\n\n      const credentials = await oauthProvider.login(callbacks);\n      setOAuthCredentialsToCache(provider, credentials);\n\n      const resolver = new CredentialResolver();\n      await resolver.saveOAuthToken(provider, {\n        access: oauthProvider.getApiKey(credentials),\n        refresh: credentials.refresh,\n        expiresAt: credentials.expires,\n        scope: Array.isArray(credentials.scope) ? credentials.scope.filter((value): value is string => typeof value === 'string') : undefined,\n        createdAt: new Date().toISOString(),\n      });\n\n      return c.json({ \n        ok: true, \n        payload: { \n          success: true,\n          provider,\n          message: 'OAuth login successful',\n          expires: credentials.expires,\n          authUrl: authResult?.url,\n          deviceCode: authResult?.deviceCode,\n          verificationUri: authResult?.verificationUri,\n          instructions: authResult?.instructions,\n          usesCallbackServer: oauthProvider.usesCallbackServer ?? false,\n          manualCodeRequested,\n        } \n      });\n    } catch (err) {\n      console.error('OAuth login error:', err);\n      return c.json({ \n        error: err instanceof Error ? err.message : 'OAuth login failed' \n      }, 500);\n    }\n  });\n\n  /**\n   * GET /api/auth/oauth/:provider\n   * Check OAuth status for a provider\n   */\n  oauth.get('/:provider', async (c) => {\n    const provider = c.req.param('provider');\n    const credentials = getOAuthCredentialsFromCache(provider);\n    const authState = await getProviderAuthState(provider);\n    const configured = await isProviderConfigured(provider);\n\n    return c.json({ \n      ok: true, \n      payload: { \n        configured: configured || !!credentials,\n        authMode: authState.authMode,\n        authStatus: authState.authStatus,\n        expiresAt: authState.expiresAt ?? credentials?.expires,\n      } \n    });\n  });\n\n  /**\n   * DELETE /api/auth/oauth/:provider\n   * Revoke OAuth credentials\n   */\n  oauth.delete('/:provider', async (c) => {\n    const provider = c.req.param('provider');\n    \n    deleteOAuthCredentialsFromCache(provider);\n    const resolver = new CredentialResolver();\n    await resolver.deleteProviderCredential(provider);\n\n    return c.json({ ok: true, payload: { disconnected: provider } });\n  });\n\n  /**\n   * GET /api/auth/oauth\n   * List available OAuth providers\n   */\n  oauth.get('/', (c) => {\n    const result = Object.entries(OAUTH_PROVIDERS).map(([id, p]) => ({\n      id,\n      name: p.name,\n    }));\n\n    return c.json({ ok: true, payload: { providers: result } });\n  });\n\n  return oauth;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;kBAuB+D;gBACuB;AAGtF,MAAM,kBAA0D;CAC9D,eAAe;CACf,WAAW;CACX,cAAc;CACd,aAAa;CACb,kBAAkB;CAClB,qBAAqBA;CACrB,sBAAsBC;CACtB,gBAAgB;CACjB;AAGD,MAAM,wCAAuD,IAAI,KAAK;AAEtE,SAAS,6BAA6B,UAAgD;AACpF,QAAO,sBAAsB,IAAI,SAAS;;AAG5C,SAAS,2BAA2B,UAAkB,OAA+B;AACnF,uBAAsB,IAAI,UAAU,MAAM;;AAG5C,SAAS,gCAAgC,UAAwB;AAC/D,uBAAsB,OAAO,SAAS;;;AAIxC,SAAgB,4BAA4B,UAAgC;AAE5E,SAAgB,mBAAmB,UAA0B;CAC3D,MAAM,QAAQ,IAAI,MAAM;;;;;AAMxB,OAAM,KAAK,UAAU,OAAO,MAAM;EAChC,MAAM,EAAE,aAAa,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;AAEzD,MAAI,CAAC,SACH,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;EAGvD,MAAM,gBAAgB,gBAAgB;AACtC,MAAI,CAAC,cACH,QAAO,EAAE,KAAK,EAAE,OAAO,2BAA2B,YAAY,EAAE,IAAI;AAGtE,MAAI;GACF,IAAI,aAAkB;GACtB,IAAI,sBAAsB;GAsC1B,MAAM,cAAc,MAAM,cAAc,MAAM;IAnC5C,SAAS,SAAiD;AACxD,kBAAa;MAAE,KAAK,KAAK;MAAK,cAAc,KAAK;MAAc;;IAEjE,eAAe,SAAS;AACtB,kBAAa;MACX,KAAK,KAAK;MACV,cAAc,cAAc,KAAK;MACjC,SAAS,QAAQ,KAAK,gBAAgB,kBAAkB,KAAK;MAC7D,YAAY,KAAK;MACjB,iBAAiB,KAAK;MACvB;;IAEH,UAAU,OAAO,WAA+E;AAC9F,kBAAa;MACX,SAAS,OAAO;MAChB,YAAY,OAAO;MACnB,iBAAiB,OAAO;MACzB;AACD,YAAO,OAAO,cAAc;;IAE9B,aAAa,YAAoB;AAC/B,aAAQ,IAAI,mBAAmB,QAAQ;;IAEzC,mBAAmB,YAAY;AAE7B,2BAAsB;AAEtB,YAAO;;IAET,UAAU,OAAO,WAAW;AAE1B,YADsB,OAAO,QAAQ,MAAM,WAAW,OAAO,OAAO,UAChD,EAAE,MAAM,OAAO,QAAQ,IAAI;;IAII,CAAC;AACxD,8BAA2B,UAAU,YAAY;AAGjD,SAAM,IADe,oBACP,CAAC,eAAe,UAAU;IACtC,QAAQ,cAAc,UAAU,YAAY;IAC5C,SAAS,YAAY;IACrB,WAAW,YAAY;IACvB,OAAO,MAAM,QAAQ,YAAY,MAAM,GAAG,YAAY,MAAM,QAAQ,UAA2B,OAAO,UAAU,SAAS,GAAG,KAAA;IAC5H,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC,CAAC;AAEF,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP,SAAS;KACT;KACA,SAAS;KACT,SAAS,YAAY;KACrB,SAAS,YAAY;KACrB,YAAY,YAAY;KACxB,iBAAiB,YAAY;KAC7B,cAAc,YAAY;KAC1B,oBAAoB,cAAc,sBAAsB;KACxD;KACD;IACF,CAAC;WACK,KAAK;AACZ,WAAQ,MAAM,sBAAsB,IAAI;AACxC,UAAO,EAAE,KAAK,EACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,sBAC7C,EAAE,IAAI;;GAET;;;;;AAMF,OAAM,IAAI,cAAc,OAAO,MAAM;EACnC,MAAM,WAAW,EAAE,IAAI,MAAM,WAAW;EACxC,MAAM,cAAc,6BAA6B,SAAS;EAC1D,MAAM,YAAY,MAAM,qBAAqB,SAAS;EACtD,MAAM,aAAa,MAAM,qBAAqB,SAAS;AAEvD,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,YAAY,cAAc,CAAC,CAAC;IAC5B,UAAU,UAAU;IACpB,YAAY,UAAU;IACtB,WAAW,UAAU,aAAa,aAAa;IAChD;GACF,CAAC;GACF;;;;;AAMF,OAAM,OAAO,cAAc,OAAO,MAAM;EACtC,MAAM,WAAW,EAAE,IAAI,MAAM,WAAW;AAExC,kCAAgC,SAAS;AAEzC,QAAM,IADe,oBACP,CAAC,yBAAyB,SAAS;AAEjD,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,cAAc,UAAU;GAAE,CAAC;GAChE;;;;;AAMF,OAAM,IAAI,MAAM,MAAM;EACpB,MAAM,SAAS,OAAO,QAAQ,gBAAgB,CAAC,KAAK,CAAC,IAAI,QAAQ;GAC/D;GACA,MAAM,EAAE;GACT,EAAE;AAEH,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,WAAW,QAAQ;GAAE,CAAC;GAC3D;AAEF,QAAO"}

package/dist/src/gateway/hono/routes/agents.js

@@ -1,12 +1,14 @@
 import { init_agent_scope, normalizeAgentId } from "../../../agent/agent-scope.js";
+import { init_localized_text, normalizeLocalizedText } from "../../../config/localized-text.js";
 import { init_schema, parseModelRef } from "../../../config/schema.js";
 import { init_providers, isProviderConfigured, resolveModel } from "../../../providers/index.js";
 import { getVoiceModelsConfig } from "../../../config/voice.js";
-import { agentModelFallbacksToArray, agentModelRefToString } from "../lib/agent-model.js";
 import { deleteAgentAvatarFile, finalizeCreateAgentDirs, listAgentProfileFiles, listGatewayAgents, prepareCreateAgent, prepareCreateAgentsBatch, prepareDeleteAgent, prepareUpdateAgent, readAgentAvatarFile, readAgentProfileFile, runAfterDeletePurge, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
 import { resolveImageGenerationCapabilities, resolveImageUnderstandingCapabilities } from "../../image-capabilities.js";
+import { agentModelFallbacksToArray, agentModelRefToString } from "../lib/agent-model.js";
 //#region src/gateway/hono/routes/agents.ts
 init_schema();
+init_localized_text();
 init_providers();
 init_agent_scope();
 function parseProfileFiles(raw) {
@@ -22,14 +24,29 @@ function parseProfileFiles(raw) {
 function isParseError(value) {
 	return typeof value === "object" && value !== null && "error" in value && typeof value.error === "string";
 }
+function parseLocalizedText(raw, fieldName) {
+	if (raw === void 0) return;
+	if (typeof raw === "string") return raw;
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return { error: `${fieldName} must be a string or locale map` };
+	const localized = {};
+	for (const [locale, text] of Object.entries(raw)) {
+		if (typeof text !== "string") return { error: `${fieldName}.${locale} must be a string` };
+		localized[locale] = text;
+	}
+	return normalizeLocalizedText(localized);
+}
 function parseCreateAgentBody(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return { error: "each agent must be an object" };
 	const body = raw;
-	const name = typeof body.name === "string" ? body.name : "";
+	const parsedName = parseLocalizedText(body.name, "name");
+	if (isParseError(parsedName)) return parsedName;
+	const parsedDescription = parseLocalizedText(body.description, "description");
+	if (isParseError(parsedDescription)) return parsedDescription;
+	const name = parsedName ?? "";
 	const workspace = typeof body.workspace === "string" ? body.workspace : "";
 	const model = typeof body.model === "string" ? body.model : void 0;
 	const agentDir = typeof body.agentDir === "string" ? body.agentDir : void 0;
-	const description = typeof body.description === "string" ? body.description : void 0;
+	const description = parsedDescription;
 	const id = typeof body.id === "string" ? body.id : void 0;
 	const toolsDisable = Array.isArray(body.toolsDisable) ? body.toolsDisable.map((x) => String(x).trim()).filter(Boolean) : void 0;
 	let profileFiles;
@@ -38,6 +55,7 @@ function parseCreateAgentBody(raw) {
 		if (isParseError(parsed)) return parsed;
 		profileFiles = parsed;
 	}
+	const cloneFrom = typeof body.cloneFrom === "string" ? body.cloneFrom : void 0;
 	return {
 		name,
 		workspace,
@@ -46,14 +64,15 @@ function parseCreateAgentBody(raw) {
 		...id !== void 0 ? { id } : {},
 		...description !== void 0 ? { description } : {},
 		...toolsDisable !== void 0 ? { toolsDisable } : {},
-		...profileFiles !== void 0 ? { profileFiles } : {}
+		...profileFiles !== void 0 ? { profileFiles } : {},
+		...cloneFrom !== void 0 ? { cloneFrom } : {}
 	};
 }
 function registerAgentsRoutes(authenticated, deps) {
 	const { service, strictRateLimitMiddleware } = deps;
 	authenticated.get("/api/agents", async (c) => {
 		const cfg = service.currentConfig;
-		const payload = await listGatewayAgents(cfg);
+		const payload = await listGatewayAgents(cfg, { locale: c.req.query("locale") || c.req.header("Accept-Language")?.split(",")[0]?.trim() });
 		return c.json({
 			ok: true,
 			payload
@@ -104,7 +123,7 @@ function registerAgentsRoutes(authenticated, deps) {
 			}, finalized.status ?? 400);
 			agentIds.push(item.agentId);
 		}
-		const agentsPayload = await listGatewayAgents(cfg);
+		const agentsPayload = await listGatewayAgents(cfg, { locale: c.req.query("locale") || c.req.header("Accept-Language")?.split(",")[0]?.trim() });
 		return c.json({
 			ok: true,
 			payload: {
@@ -139,12 +158,16 @@ function registerAgentsRoutes(authenticated, deps) {
 			ok: false,
 			error: { message: save.error ?? "save failed" }
 		}, 500);
-		const finalized = await finalizeCreateAgentDirs(service.currentConfig, agentId, { ...parsed.profileFiles !== void 0 ? { profileFiles: parsed.profileFiles } : {} });
+		const finalized = await finalizeCreateAgentDirs(service.currentConfig, agentId, {
+			...parsed.profileFiles !== void 0 ? { profileFiles: parsed.profileFiles } : {},
+			...parsed.cloneFrom ? { cloneFrom: parsed.cloneFrom } : {}
+		});
 		if (finalized.ok === false) return c.json({
 			ok: false,
 			error: { message: finalized.error }
 		}, finalized.status ?? 400);
-		const agentsPayload = await listGatewayAgents(service.currentConfig);
+		const locale = c.req.query("locale") || c.req.header("Accept-Language")?.split(",")[0]?.trim();
+		const agentsPayload = await listGatewayAgents(service.currentConfig, { locale });
 		return c.json({
 			ok: true,
 			payload: {
@@ -166,9 +189,27 @@ function registerAgentsRoutes(authenticated, deps) {
 		}
 		const skillsPatch = body.skills === null ? null : Array.isArray(body.skills) ? body.skills.map((x) => String(x).trim()).filter(Boolean) : void 0;
 		const toolsDisablePatch = body.toolsDisable === null ? null : Array.isArray(body.toolsDisable) ? body.toolsDisable.map((x) => String(x).trim()).filter(Boolean) : void 0;
-		const descriptionPatch = Object.hasOwn(body, "description") ? body.description === null ? null : typeof body.description === "string" ? body.description : void 0 : void 0;
+		let namePatch;
+		if (Object.hasOwn(body, "name")) {
+			const parsedName = parseLocalizedText(body.name, "name");
+			if (isParseError(parsedName)) return c.json({
+				ok: false,
+				error: { message: parsedName.error }
+			}, 400);
+			namePatch = parsedName;
+		}
+		let descriptionPatch;
+		if (Object.hasOwn(body, "description")) if (body.description === null) descriptionPatch = null;
+		else {
+			const parsedDescription = parseLocalizedText(body.description, "description");
+			if (isParseError(parsedDescription)) return c.json({
+				ok: false,
+				error: { message: parsedDescription.error }
+			}, 400);
+			descriptionPatch = parsedDescription;
+		}
 		const prep = prepareUpdateAgent(service.currentConfig, id, {
-			name: typeof body.name === "string" ? body.name : void 0,
+			name: namePatch,
 			...descriptionPatch !== void 0 ? { description: descriptionPatch } : {},
 			workspace: typeof body.workspace === "string" ? body.workspace : void 0,
 			model: body.model === null ? null : typeof body.model === "string" ? body.model : void 0,
@@ -186,7 +227,8 @@ function registerAgentsRoutes(authenticated, deps) {
 			ok: false,
 			error: { message: save.error ?? "save failed" }
 		}, 500);
-		const agentsPayload = await listGatewayAgents(service.currentConfig);
+		const locale = c.req.query("locale") || c.req.header("Accept-Language")?.split(",")[0]?.trim();
+		const agentsPayload = await listGatewayAgents(service.currentConfig, { locale });
 		return c.json({
 			ok: true,
 			payload: agentsPayload
@@ -207,7 +249,8 @@ function registerAgentsRoutes(authenticated, deps) {
 			error: { message: save.error ?? "save failed" }
 		}, 500);
 		if (purge) await runAfterDeletePurge(service.currentConfig, agentId);
-		const agentsPayload = await listGatewayAgents(service.currentConfig);
+		const locale = c.req.query("locale") || c.req.header("Accept-Language")?.split(",")[0]?.trim();
+		const agentsPayload = await listGatewayAgents(service.currentConfig, { locale });
 		return c.json({
 			ok: true,
 			payload: {